# OneLogin authentication bypass on WordPress sites

OneLogin SAML WordPress plugin skipped signature verification when the ds:Signature tag was absent, letting an attacker forge a SAML assertion and log in as administrator on newsroom.uber.com.

- Payout: $10,000
- Severity: critical
- Program: Uber
- Credited: jouko
- Disclosed: 2016-06-06
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/136169
- Library page: https://bugbountylibrary.com/r/h1%3A136169
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical tech:php tech:saml tech:sso tech:wordpress technique:source-review vuln:access-control vuln:auth-bypass

**Target:** WordPress OneLogin SAML-SSO plugin (onelogin_saml.php ACS endpoint)
**Root cause:** In Response.php isValid(), the signature verification is wrapped in `if (!empty($signedElements))`, so a SAML response with no <ds:Signature/> tag is accepted as authentic without any cryptographic check.
**Steps:**
1. Capture a valid OneLogin SAML response and strip the <ds:Signature/> element (and other unneeded data).
2. Set attacker-controlled attributes: User.Username, User.email, memberOf (role), NameID.
3. Base64-encode the XML into SAMLResponse.
4. POST to `https://newsroom.uber.com/wp-content/plugins/onelogin-saml-sso/onelogin_saml.php?acs` with `RelayState=/wp-login.php` and `SAMLResponse=<b64>`.
5. Plugin accepts response, sets wordpress_logged_in / saml_login cookies and redirects; copy cookies to browser to act as admin.
**How found:** Researcher was probing whether WP-OneLogin stored sensitive info usable against OneLogin, then read the plugin source and noticed the signature check was gated behind a non-empty signedElements check, meaning omitting the signature tag bypasses verification.
**Exploitation:** Attacker forges an unsigned SAML assertion with chosen username/email/role and POSTs it to the plugin's ACS endpoint. Plugin creates the user if provisioning is on and issues authenticated WordPress cookies, granting the attacker a logged-in session at the role specified in memberOf.
**Escalation:** Guessing role name 'administrator' (or an existing admin's email/username) on newsroom.uber.com yielded full WordPress administrator; on eng.uber.com only subscriber was achievable without guessing admin identifiers.
**Insight:** In SAML SP plugins, check whether signature validation is conditional on the presence of a signature element; if the code path is skipped when the tag is absent, an unsigned assertion is accepted. Strip the signature tag from a valid response and replay it.