SAML Is Insecure by Design

Re:SAML Is Insecure by Design by tptacek on Thursday August 05, 2021 @06:50PM (#28081093)

This is neat, because every program that actually uses this library probably has the AudienceRestriction authz vulnerability. It doesn't look like it's checking the Response Destination= field either.

[ Parent | on HN ]

Re:SAML Is Insecure by Design by stouset on Thursday August 05, 2021 @07:15PM (#28081302)

I'd wager that most SAML implementations are a rich, bountiful source of severe security bugs. If I ever decided to get into bug bounty programs I'd absolutely start here.

FWIW, yep. It has no knowledge of AudienceRestriction:

    $ grep -i AudienceRestriction Saml.cs
    $

[ Parent | on HN ]