SAML attacks: the signature nobody checks properly

In SAML SSO the Identity Provider signs an XML assertion saying "this is user X". The Service Provider verifies the signature and trusts it. The attacks break that link.

XML Signature Wrapping

The signed XML and the processed XML can diverge. The attacker adds a second (unsigned) assertion placed where the parser reads it, keeping the signature valid on the hidden original. The SP verifies one part and uses another.

Comment injection

An XML comment inside the NameID (admin<!--x-->@evil) can make the library read only admin, impersonating another user.

Defence

Verify the signed element is exactly the one used (schema hardening, absolute references). Use up-to-date SAML libraries that fix wrapping. Pin the IdP certificate and validate Audience, NotOnOrAfter, Recipient.