Claude AI Finds SAML Security Flaws That Can Let Attackers Take Over Accounts

Security researchers have used Anthropic’s Claude AI to uncover serious flaws in Security Assertion Markup Language (SAML) implementations that could allow attackers to bypass authentication and take over user accounts.

The findings highlight the persistent security risks created by XML signature processing, inconsistent parser behavior, and custom SAML code.

A researcher at Oblique Security built an AI-assisted testing harness around Claude Opus to examine SAML libraries and applications.

Rather than directing the model to reproduce known bugs, the system supplied a threat model and let Claude explore how each implementation handled signed XML data.

The process separated the discovery of unusual parser behavior from validation, in which the model attempted to create a working end-to-end exploit.

Claude AI Finds SAML Flaws

SAML is widely used for enterprise single sign-on, allowing an identity provider to send signed authentication assertions to a service provider. However, secure implementation depends on both components interpreting the same XML document in the same way.

When signature verification and application logic process XML differently, attackers may be able to supply unsigned identity data that the application mistakenly trusts.

The research identified full authentication bypasses in four projects, including Authentik, PHP litesaml/lightsaml, OneUptime, and Java saml-client.

In three cases, the issue involved SAML signature wrapping, a long-standing attack class in which an attacker moves or injects XML elements so that a valid signature is verified on a different object. At the same time, the application reads identity information from another.

The most notable issue affected Authentik, an open-source identity provider. Tracked as CVE-2026-57580, the flaw allowed an attacker to use an XML comment inside a SAML NameID value.

Under certain non-default account-matching modes, Authentik could interpret the value before the comment as a victim’s username or email, even while the signed assertion remained valid. This could link an attacker-controlled external identity to the victim’s account, creating a persistent path to account takeover.

Authentik fixed the vulnerability in versions 2026.2.6 and 2026.5.5. Organizations using inbound SAML sources with USERNAME_LINK or EMAIL_LINK matching should verify that they have applied the update.

The vendor noted that default unique-identifier matching and outbound SAML provider deployments were not affected. The investigation also uncovered weaknesses outside standard SAML login responses.

According to Oblique Security research, signature validation bypasses in authentication requests, attribute queries, and logout operations could enable information disclosure or arbitrary user logouts.

Denial-of-service risks were also common. Several libraries accepted attacker-controlled XML documents that could trigger excessive memory usage during signature validation or XML transformation.

Such weaknesses are especially dangerous because they can often be exploited before authentication. The findings reinforce a familiar message for identity teams: avoid custom SAML implementations whenever possible.

Developers should use mature, actively maintained libraries, strictly validate signed elements, turn off dangerous XML transforms, impose document-size and resource limits, and test identity flows for parser differentials and signature wrapping attacks.

AI can accelerate vulnerability discovery, but it can also expose how fragile legacy XML-based authentication implementations remain.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC