Unverified50% confidenceFactExact time
Similar historical cases include the Duo Labs SAML vulnerabilities disclosed in 2018 (involving XML comments and namespace confusion), the GitHub Enterprise SAML bypass, and the earlier XML Signature Wrapping (XSW) attack.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSAML is built on top of XML and relies heavily on XML Digital Signatures (XML DSig) and XML Encryption.69% similarUnverifiedAfter XSW attacks were systematically studied around 2012, researchers discovered variant vulnerabilities in several mainstream SAML implementations including Shibboleth and OpenSAML.68% similarUnverifiedThere are four SAML authentication bypass vulnerabilities, whose common root cause is that the same SAML response is interpreted as different content by different parsers or expressions in the signature verification and identity extraction steps.66% similarUnverifiedThe core approach to reducing SAML risk is to isolate SAML processing, avoiding hand-written XML parsing and signature verification logic, and instead using audited mature libraries or dedicated identity gateways.64% similarUnverified早期版本的 Marked.js（CVE-2017-1000427）和 showdown 等库曾因对用户输入过滤不足导致 XSS 漏洞被公开披露62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1032383API
curl https://kongchang.com/api/v1/knowledge/claims/1032383MCP
get_claim(id=1032383)