AI Uncovers Critical SAML Flaws Leading to Account Takeovers
Researchers leveraged Anthropic's Claude AI to identify significant security vulnerabilities in SAML implementations, enabling attackers to bypass authentication and seize control of user accounts.
Security researchers have employed Anthropic's Claude AI to uncover critical flaws within Security Assertion Markup Language (SAML) implementations, a widely used standard for enterprise single sign-on. These vulnerabilities could allow malicious actors to bypass authentication mechanisms and gain unauthorized access to user accounts. The findings underscore the persistent security risks associated with XML signature processing, inconsistencies in parser behavior, and custom SAML code.
A researcher at Oblique Security developed an AI-assisted testing framework centered around Claude Opus. This system was designed not to reproduce known bugs, but rather to explore how various SAML libraries and applications handled signed XML data based on a provided threat model. The AI's role was to identify unusual parser behaviors and then attempt to construct end-to-end exploits.
SAML facilitates secure authentication by enabling an identity provider to issue signed assertions to a service provider. The security of this process hinges on both parties interpreting the same XML document identically. When signature verification and application logic diverge in their XML processing, attackers can potentially inject unsigned identity data that the application erroneously trusts.
The research team identified complete authentication bypasses in four distinct projects: Authentik, PHP litesaml/lightsaml, OneUptime, and Java saml-client. In three of these instances, the exploitation method involved SAML signature wrapping, a known attack vector where an attacker manipulates XML elements to ensure a valid signature is applied to a different object than the one the application reads for identity information.
A particularly significant vulnerability, tracked as CVE-2026-57580, was discovered in Authentik, an open-source identity provider. This flaw allowed an attacker to embed an XML comment within a SAML NameID value. In specific, non-default account-matching configurations, Authentik could misinterpret the portion of the NameID before the comment as a victim's username or email, even while the assertion's signature remained valid. This enabled attackers to associate an external identity they controlled with a victim's account, creating a persistent pathway for account takeover.
Authentik has since addressed this vulnerability in versions 2026.2.6 and 2026.5.5. The vendor advises organizations utilizing inbound SAML sources with USERNAME_LINK or EMAIL_LINK matching to ensure they have applied the necessary updates. Deployments using the default unique-identifier matching or outbound SAML providers were not affected.
Beyond the primary authentication flow, the investigation also revealed weaknesses in other SAML operations. Oblique Security's research indicated that bypasses in signature validation for authentication requests, attribute queries, and logout operations could lead to sensitive information disclosure or enable attackers to force arbitrary user logouts. Additionally, several libraries exhibited denial-of-service vulnerabilities, accepting malformed XML documents that could consume excessive memory during signature validation or XML transformation, posing a risk even before user authentication.
These findings reinforce the critical importance of avoiding custom SAML implementations. Developers are strongly advised to utilize mature, well-maintained libraries, rigorously validate all signed elements, disable potentially dangerous XML transforms, enforce resource and document size limits, and thoroughly test identity flows for parser discrepancies and signature wrapping vulnerabilities. While AI can accelerate vulnerability discovery, it also highlights the inherent fragility of legacy XML-based authentication systems.