SAML Unsigned-Assertion Acceptance

A SAML Service Provider (SP) must verify that an assertion is signed by the trusted IdP and that the signature covers the asserted content. Implementations that check only for the presence of a <Signature> element — or skip verification when it's absent — can be fed forged identities.

How it works

Common failure modes:

• Presence-only check: the SP confirms a <Signature> element exists but never validates it cryptographically. Strip or fake the SignatureValue and change role to admin.
• Optional signing: if the SP processes unsigned assertions when no signature is present, send an entirely forged, unsigned assertion.
• Wrong reference: the signature validates a benign element while attributes are read from an unsigned one (see signature wrapping).

How to test

Submit a SAMLResponse with (a) no signature, (b) a corrupted SignatureValue, and (c) modified attributes but the original signature. Any acceptance of altered identity data is a finding.

Impact

Complete SSO authentication bypass — impersonate arbitrary users.

Defenses

• Require a valid signature from the configured IdP certificate; fail closed when absent or invalid.
• Verify the signature reference binds to the consumed assertion; pin the IdP certificate.