Hacking SAML with Claude Code | Oblique

Docs

How it works

Blog

Book a demoJoin waitlist

h2]:mb-4 [&>h2]:mt-8 [&>h2]:text-2xl [&>h2]:font-medium [&>h3]:mb-3 [&>h3]:mt-6 [&>h3]:text-xl [&>h3]:font-medium [&>p]:leading-7 [&>ul>li]:leading-7 [&>ul]:my-6 [&>ul]:list-disc [&>ul]:space-y-2 [&>ul]:pl-6"><br>I’ve worked with the SAML protocol ever since I made the unfortunate decision to add support to Dex almost a decade ago. SAML is often described as actively dangerous due to the brain melting technology that is XML Digital Signatures. Every SAML library I’ve ever interacted with has eventually been found to have a full authentication bypass, and my own implementation in Dex resulted in multiple vulnerabilities.<br>A couple months ago, I used this experience to give a talk on the history of SAML vulnerabilities at the Sec Nerds SF conference. This was an opportunity for me to rant a little, but also brush up on bypass techniques and the latest research in the area.<br>Around this time, I was reading Niels Provos’s “Finding Zero-Days with Any Model” and started to wonder what would happen if I took my research on SAML vulnerabilities and gave it to a harness. I applied to Anthropic’s Cyber Verification Program to remove the guardrails on my account, and after being accepted, I had access to an Opus model that could write exploits fed by my research and prompting.<br>I like to claim that SAML is a bad protocol, but could I prove it?<br>During my spare time over the course of a month or so, I attempted to hack every SAML implementation I could find. While I wasn’t able to structurally break the protocol (much to my chagrin), there were plenty of bugs, many of which are still live today.<br>Find me vulnerabilities, Claude<br>One of the core differences between asking Claude to code and asking it to hack is scale. Even in a large codebase, the amount of context needed to track down an individual bug or implement a feature can be relatively small. On the other hand, hacking is about being exhaustive, and going until you find a bug or run out of threads to chase.<br>To account for this, essentially all “hacking harnesses” (of which there are many) coalesce around a few core primitives:

Break up work between multiple agents<br>Provide storage for intermediate results that agents can use for direction<br>Prioritize, scope, and dedupe the work to be done

I built the same. (Check out the source code at: github.com/oblique-security/saml-research)<br>Building the harness was easy. What I was still surprised by (even despite all the coverage of Mythos, OpenAI/Hugging Face, and model escapes) was that I didn’t really need to teach Claude Opus how to hack. Giving Claude a corpus of vulnerabilities often devolved into it trying to find replicas of those exact issues in other libraries. I found better results by providing a threat model and then letting Claude do its own exploration. This is similar to my experience with agentic coding: as the models get better, you provide fewer specific instructions, and more general guidance.<br>My pipeline settled on two core phases. A “gadget” phase attempting to find weird behavior in the underlying libraries, and a “findings” phase that combines gadgets then confirms them by writing an end-to-end exploit. These are written to JSONL files, which different steps perform operations on. For example, a step that rejects proposed findings that are out-of-scope before spending tokens to prove them.<br>Here’s an example of a gadget that Claude found in Node’s xml-crypto’s handling of processing instructions:<br>"id": "g-0005",<br>"title": "C14N DIFFERENTIAL -- processing instructions are FLATTENED to their data text: `` canonicalizes to the bare characters `echo 1;`",<br>"impacts": [<br>"s-0108",<br>"s-0126",<br>"s-0210"<br>],<br>"status": "confirmed"<br>}Which the finding phase later turned into an email truncation bypass:

- not-an-admin@example.com<br>+ admin@example.com

Investigating every SAML implementation<br>It was now time to take my Claude Max 20x plan and see what my pipeline could find.<br>Since 2020, there’s been a bypass in a major SAML library about once a quarter. GitHub Enterprise alone had four across 2024-2025 (CVE-2024-4985, CVE-2024-6800, CVE-2024-9487, CVE-2025-23369). Essentially all of these stem from components interpreting XML in subtly different ways, and mistakenly processing unsigned data as if it was verified. Today many libraries have adopted hardened APIs that attempt to defend against these kinds of attacks.<br>While I wasn’t able to set the Internet ablaze, I was able to find full authentication bypasses in four different projects:

Authentik : Injecting a comment in NameID can be used to truncate to another user’s account and authenticate as them (CVE-2026-57580)<br>PHP litesaml/lightsaml : Signature wrapping on Response message (CVE-2026-63182)<br>OneUptime : Signature wrapping on Response message (OneUptime/oneuptime#2949)<br>Java’s saml-client : Signature wrapping on Response message (justinbleach/saml-client#149)

Again, if you’re ever...