Trail of Bits Blog company blog

SAML: A fractal of bad design

by "Matt Schwager" blog.trailofbits.com published 2026-09-2111 min read

SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…

Points

354

HN comments

190

Submissions

1

Cited by

0 commenters

Security & PrivacyWeb & Frontend2026

Related posts from the same era

Claude Code is steganographically marking requests

Thereallo20262,445 points750 commentscited by 3 details

Motorola announces a partnership with GrapheneOS

Motorola News20262,358 points884 commentscited by 10 details

The newest Instagram “exploit” is the goofiest I've seen

SSid20262,210 points491 commentscited by 3 details

Everyone knows your location: tracking myself down through in-app ads

Tim Shmykov20251,957 points600 commentscited by 3 details

Axios compromised on NPM – Malicious versions drop remote access trojan

StepSecurity Blog20261,934 points807 comments details

Our investigation into the suspicious pressure on Archive.today

AdGuard DNS Blog20251,816 points443 comments details