XML Signature Wrapping (XSW) Attacks on SAML, Explained

XML signature wrapping (XSW) is a SAML attack in which a response retains a valid XML signature over a legitimate assertion while an application reads identity data from a separate forged, unsigned assertion, allowing attackers who possess any IdP-issued assertion to potentially impersonate another user without stealing signing keys. The vulnerability arises when signature validation and application identity parsing select different XML elements, a problem documented in 2012 research and reflected in recent critical flaws including ruby-saml CVE-2024-45409 and CVE-2025-25291, and samlify CVE-2025-47949. Recommended defenses include consuming identity data only from the exact element verified by the signature library, rejecting responses containing multiple assertions or encrypted assertions, enforcing unique IDs and expected XML structure, using a single parser, disabling DTD processing, and preferably requiring response-level signatures as an additional safeguard. The mock-idp testing tool can generate forged responses to assess service providers, and tests described found that node-saml rejected multiple assertions while crewjam/saml discarded the unsigned forged assertion, though applications can reintroduce risk by re-parsing raw SAML XML after validation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.