Trail of Bits is right about SAML. You still have to support it.

Trail of Bits argues that SAML’s XML signature design and broad specification create persistent security risks and recommends replacing it with OpenID Connect, but the author contends that SaaS vendors cannot universally abandon SAML because enterprise customers often depend on legacy identity providers, federations, or established configurations. The discussion highlights recent SAML vulnerabilities involving not only XML canonicalization and parser disagreements but also surrounding implementation flaws such as insecure account linking, configuration access controls, redirects, certificate validation, and replay protection. While OIDC is generally simpler and avoids many XML-related problems, provider-specific compatibility differences and JWT validation failures show that it does not eliminate identity security risks. The author recommends offering OIDC first while retaining SAML where customer requirements demand it, carefully validating all assertions and tokens, securing administrative SSO configuration, using stable identity attributes, and considering managed identity services that abstract protocol-specific parsing and provisioning work.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.