SAML

Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables single sign-on across enterprise applications, allowing employees to authenticate once and access multiple services. SAML assertions are digitally signed XML documents. Known vulnerabilities include XML signature wrapping attacks and comment injection in assertion XML.

Why it matters for your website

• 1Directly impacts resistance to account takeover and credential theft
• 2Required for SOC 2, HIPAA, and PCI-DSS compliance
• 3Misconfiguration can expose all user accounts to attack