Unverified50% confidenceFactExact time
A SAML response is digitally signed XML, and its signature verification and identity attribute extraction often use different XML parsers, different XPath expressions or different namespace handling, causing parser differential inconsistency.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedA SAML assertion is an XML-format security token issued by an enterprise IdP and digitally signed using the IdP's private key.70% similarUnverifiedThe root cause of XML Signature Wrapping attacks lies in the ambiguity between node references under XPath semantics and actual processing paths in XML documents, allowing attackers to inject forged assertion nodes so that signature validation passes while the effective identity is tampered with.65% similarUnverifiedXML signatures allow signing a subset of a document, and the verifying party must determine which part has been signed.64% similarUnverifiedHard rules for handling signed XML include: prohibit multiple parsers from processing the same security-sensitive XML, perform C14N before signature verification and extract identity based on the canonicalized result, strictly validate namespaces, and use absolute paths in XPath.62% similarUnverifiedAn attacker can craft a piece of XML so that the signature verifier reads user A's data while the identity extractor reads user B's identity (usually an administrator), thereby bypassing the system while the signature remains valid.56% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1032376API
curl https://kongchang.com/api/v1/knowledge/claims/1032376MCP
get_claim(id=1032376)