Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them

Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.

Part of a login portal security series, covering how login submissions, account registration, and password reset flows can leak valid usernames through overly helpful server responses.

Introduces a web security series on login portals, framing attack surface concepts and contrasting unauthenticated versus authenticated vulnerability classes before deeper defensive topics.

Covers an out-of-band XXE technique that uses an external DTD hosted on an attacker server to exfiltrate local files when the vulnerable application does not reflect responses.

GitLab explains improved restricted access seat controls: when seats run out, users provisioned via SAML, SCIM or LDAP get a non-billable Minimal Access role, while existing members are unaffected.