Our response to four SAML vulnerabilities, from report to remediation

WorkOS disclosed four SAML authentication vulnerabilities reported between September 24 and 27, 2026 that could have allowed attackers with access to a legitimately trusted signing key, potentially including publicly available IdP metadata in some cases, to craft SAML responses and impersonate users on targeted SSO connections. The flaws stemmed from a “dual-view” problem in which WorkOS’s signature verifier and application logic could parse or interpret the same XML response differently, enabling genuine signatures to validate while identity information was taken from attacker-controlled content outside the signed material. WorkOS blocked the initial issue within about 100 minutes, deployed controls covering all identified variants by September 27, and added structural hardening on October 1 so sign-in validation and identity extraction use verified content returned by xml-crypto’s getSignedReferences() API. The company found no evidence of exploitation beyond researcher and customer testing, required no customer action, and recommended that developers processing signed XML make all authentication decisions from verified content, avoid unsafe parsing or serialization differences, and perform full SAML validation beyond signature checks.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.