---
id: 8525
title: "SAML: A fractal of bad design"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/"
published_at: "2026-09-21T11:00:00Z"
tags: ["authentication", "sso", "xml", "protocol-design", "saml", "openid-connect", "signature-wrapping"]
phying_url: "https://phying.com/item/8525"
lang: en
---

# SAML: A fractal of bad design

## Summary

Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2026-09-21T11:00:00Z
- **Original:** https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/
- **Phying News:** https://phying.com/item/8525