Other nomination

The Fragile Lock: Novel Bypasses For SAML Authentication

Zakhar Fedotkin · PortSwigger Research · 10 December 2025

Parser inconsistencies between REXML, Nokogiri and libxml2 let an attacker forge SAML responses: attribute pollution, namespace confusion via the reserved xml prefix, and a canonicalisation failure that makes the digest cover an empty string. Any identity-provider-signed XML then bypasses signature validation and grants login as any user.

Record

Researcher

Zakhar Fedotkin

Published by

PortSwigger Research

Date

10 December 2025

In the archive

• Nominated for the 2025 Top 10 Web Hacking Techniques

Related sources

• Black Hat slides
• XSW exploitation extension
• Ruby-SAML disclosure announcement
• Talk recording

Tags

• saml
• auth-bypass
• parser-differential
• sso
• ruby
• php
• cve
• tooling
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Zakhar Fedotkin, first published at the original source. Preserved copies are kept so the citation survives its host.