SAML authentication attacks

When it applies

The app authenticates via SAML SSO — the browser POSTs a base64 SAMLResponse (an XML assertion signed by the IdP) to the SP's ACS endpoint. Break the signature validation and you forge login as anyone.

Why it works

SAML security rests entirely on the SP correctly validating the XML signature over the assertion. XML signature validation is notoriously error-prone: SPs accept unsigned assertions, validate the wrong element, or can be tricked by XML Signature Wrapping (XSW) — where a signed element is kept for validation but an injected unsigned assertion is what the app actually reads.