Security researchers have harnessed Anthropic’s Claude AI to expose severe vulnerabilities in several popular implementations of Security Assertion Markup Language (SAML), demonstrating that attackers may bypass authentication and gain full control over user accounts. These flaws stem from inconsistent XML signature processing, erratic parser behavior, and risky custom SAML code.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
Oblique Security built a testing framework around Claude Opus to analyze how SAML libraries and applications handle signed XML. Instead of pointing to known bugs, the researchers provided Claude with a threat model and evaluated each implementation’s response to crafted XML. The goal was to isolate parsing oddities apart from validation logic, and then proceed to build working exploits.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
What Was Discovered
SAML is widely used for enterprise single sign-on: an identity provider issues signed assertions which a service provider trusts. For this trust to hold, both sides must interpret XML the same way. When application logic reads identity information differently than how signature verification treats it, attackers can slip in untrusted identity attributes that appear legitimate.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
The audit uncovered complete authentication bypasses in four different projects: Authentik, PHP’s litesaml/lightsaml, OneUptime, and Java’s saml-client.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/)) Three of these involved signature wrapping, an attack technique where attackers move or inject XML elements so that a valid signature covers a different object than what the application actually reads.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
The most alarming vulnerability was in Authentik (CVE-2026-57580). In certain non-default account-matching modes, an XML comment placed inside a SAML NameID could trick the system: it would treat the portion before the comment as the user’s username or email—even though the signature remained valid and protection mechanisms were in place. This allowed linking an attacker-controlled external identity to someone else’s account, enabling ongoing takeover.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/)) Authentik patched this issue in releases 2026.2.6 and 2026.5.5. Organizations using inbound SAML with USERNAME_LINK or EMAIL_LINK matching methods should ensure updates are applied.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
Wider Impacts & Recommendations
Beyond login flows, the analysis revealed vulnerabilities in authentication requests, attribute queries, and logout operations. Attackers could potentially expose data or force arbitrary logouts. Denial-of-service flaws also emerged: some libraries accepted attacker-controlled XML documents that caused excessive memory consumption during signature validation or XML transformations.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
To reduce risk, developers are urged to rely on mature, well-maintained SAML libraries rather than crafting custom implementations. Signed elements should be strictly validated, dangerous XML transforms disabled, and limits imposed on document size and resource usage. Testing identity and authentication flows for parser mismatches and signature wrapping attacks is also critical.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
The Claude-powered research underscores that although SAML has been around for years, many deployments remain fragile. The combination of legacy XML architecture, ad hoc custom code, and complexity in parsing leaves surface area for attackers.([cybersecuritynews.com](https://cybersecuritynews.com/claude-ai-finds-saml-security-flaws/))
Looking ahead, organizations using SAML for SSO must prioritize tightening XML handling and implementing defenses against signature wrapping. Vigilant patching—especially in widely shared libraries like Authentik—is essential. Without systemic improvements, similar bypasses remain possible for threat actors to exploit long after this disclosure.
