A newly disclosed critical vulnerabilities across several open-source SAML implementations through an AI-assisted research pipeline using Anthropic’s Claude Opus.
Documented by Eric Chiang, the investigation uncovered full authentication bypasses, weaknesses in XML signature validation, information disclosure risks, arbitrary logout flaws, and denial-of-service conditions.
SAML remains particularly difficult to implement securely because it depends on XML Digital Signatures. Security issues can emerge when a signature-validation library and the relying application parse or canonicalize the same XML document differently.
Claude AI Finds Full Authentication Bypasses
In those cases, an application may mistakenly accept attacker-controlled content as if it had been cryptographically verified. Chiang developed a multi-agent environment after joining Anthropic’s Cyber Verification Program.
Rather than asking Claude to find specific known flaws, he provided a threat model and allowed the system to investigate unusual behavior in XML processing, parsing, and signature validation within target codebases.
The process initially searched for potentially exploitable “gadgets,” such as dangerous canonicalization or transformation behavior, and then attempted to chain confirmed findings into proof-of-concept exploits.
Intermediate results were maintained in JSONL records to prioritize leads, remove duplicates, and filter out irrelevant issues before expensive exploit testing.
One notable finding affected the Node.js xml-crypto ecosystem. The research identified differences involving the handling of XML processing instructions during canonicalization.
This contributed to an email-truncation scenario in OneUptime, where specially crafted XML could cause downstream logic to interpret a signed SAML NameID differently from the signature-validation component.
Chiang reported complete authentication bypasses in Authentik, litesaml/lightsaml, OneUptime, and Java saml-client. In Authentik, comment injection within a SAML NameID could truncate an identity value and enable account impersonation; the issue is tracked as CVE-2026-57580.
The litesaml/lightsaml issue, tracked as CVE-2026-63182, involved a SAML Response signature-wrapping flaw. OneUptime and Java saml-client were also affected by SAML Response signature-wrapping weaknesses.
Signature wrapping attacks exploit a dangerous mismatch between the XML element validated by a cryptographic library and the element later processed by application code.
An attacker can retain a valid signature over a legitimate assertion while directing the application toward a separate malicious assertion. In an affected identity flow, that condition can produce a “login as anyone” authentication bypass.
The Authentik finding drew additional attention because eight independent researchers reportedly disclosed the same flaw simultaneously.
The overlap illustrates how AI-assisted tooling may significantly accelerate discovery of well-hidden but repeatable implementation weaknesses.
The investigation also found denial-of-service exposure in XML signature processing. Go’s xmldsig library received a fix for a quadratic memory-allocation issue during signature verification.
JavaScript’s xmldom reportedly faces similar memory-allocation concerns that can affect Node-based SAML applications. Python SAML packages were also found to permit risky XML signature transformations via libxmlsec1, including XSLT transformations that can expand unauthenticated XML into extremely large documents.
The findings underscore why organizations should avoid building custom SAML implementations and instead rely on actively maintained identity software.
Teams that must support SAML should enforce strict element selection, use hardened signature-validation APIs, restrict allowed XML transforms, apply parser resource limits, and test for signature-wrapping and canonicalization inconsistencies.
Chiang’s research demonstrates that AI can help researchers systematically examine complex protocol assumptions at a scale that conventional manual auditing may struggle to match.
However, it also signals a growing challenge for open-source maintainers, who may soon face substantially higher volumes of vulnerability reports generated or accelerated by AI-driven security research.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
