Record · corpus.blog/posts/01a0d74c-d6e6-7273-ac9b-5285cc2ee541

SAML: A fractal of bad design

Trail of Bits Blog · published 21 September 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.trailofbits.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 37
Words captured: 2,513

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://news.ycombinator.com/item?id=37564758

news.ycombinator.com

https://en.wikipedia.org/wiki/SAML

en.wikipedia.org

https://en.wikipedia.org/wiki/Waterfall_model

en.wikipedia.org

https://en.wikipedia.org/wiki/Big_design_up_front

en.wikipedia.org

https://its.umich.edu/enterprise/wifi-networks/researchers/internet2

its.umich.edu

https://web.archive.org/web/20071214140857/http://rnd.feide.no/simplesamlphp

web.archive.org

https://duo.com/docs/dag

duo.com

https://kel.bz/

kel.bz

https://i.blackhat.com/us-18/Thu-August-9/us-18-Ludwig-Identity-Theft-Attacks-On-SSO-Systems.pdf

i.blackhat.com

https://dl.acm.org/doi/10.1145/1103022.1103026

dl.acm.org

https://arxiv.org/pdf/0812.4181

arxiv.org

https://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/att-0019/Camera-Ready.pdf

lists.w3.org

https://dl.acm.org/doi/10.1145/1456396.1456397

dl.acm.org

https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf

usenix.org

https://github.com/CompassSecurity/SAMLRaider/blob/v2.5.2/src/main/java/helpers/XSWHelpers.java

github.com

https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

eev.ee

https://portswigger.net/research/the-fragile-lock

portswigger.net

https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://media1.giphy.com/media/v1.Y2lkPTc5MGI3NjExMXBhN2doeGV5eXBoamUwZDJ1M2owcW9ndDJvY2c3NnlkMzF4ZDBxbyZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/Dvw2lJqlTuJmo/giphy.gif

media1.giphy.com

https://inkdroid.org/2012/04/30/lessons-of-json/

inkdroid.org

https://datatracker.ietf.org/doc/html/rfc2119

datatracker.ietf.org

https://www.w3.org/TR/xml-exc-c14n/

w3.org

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

mattermost.com

https://mattermost.com/blog/securing-xml-implementations-across-the-web/

mattermost.com

https://repzret.blogspot.com/2025/02/abusing-libxml2-quirks-to-bypass-saml.html

repzret.blogspot.com

https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/

github.blog

https://portswigger.net/research/saml-roulette-the-hacker-always-wins

portswigger.net

https://www.w3.org/TR/xmldsig-core1/

w3.org

https://en.wikipedia.org/wiki/You_aren%27t_gonna_need_it

en.wikipedia.org

https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

docs.oasis-open.org

https://news.ycombinator.com/item?id=28080553

news.ycombinator.com

https://datatracker.ietf.org/doc/html/rfc6749

datatracker.ietf.org

https://auth0.com/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post

auth0.com

https://research.google/pubs/beyondcorp-a-new-approach-to-enterprise-security/

research.google

https://news.ycombinator.com/item?id=41676041

news.ycombinator.com

https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-exploits/

blog.trailofbits.com

https://www.trailofbits.com/contact/

trailofbits.com