# SAML assertion signature verification bypass

Assertion trusted without signature check, or verifier and attribute parser disagree on XML structure

_Area: Web authentication and account takeover. Seen in 6 disclosed reports; 6 confirmed bounties, median $5,750, range $500-$10,500; latest 2024-03-22. Updated 2026-10-23._

## How it works
A SAML service provider must prove an assertion was minted by the trusted IdP before trusting its subject and attributes. The root cause is that this proof is treated as optional or is checked against a different view of the message than the one used to make decisions. Either the signature check is skipped when the signature element is absent, or the code that validates the signature and the code that reads issuer/audience/attributes resolve the XML differently (trimming, normalization, unsigned fields). The assumption that breaks: "if we got here, the assertion was verified."

## Where it shows up
- Signature validation wrapped in a conditional on the signature element existing (`if (!empty($signedElements))`) [E1](https://bugbountylibrary.com/r/h1%3A136169.md).
- ACS endpoints that accept any well-formed assertion and complain about missing attributes rather than invalid signature [E4](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-uber-bug-bounty-gaining-access-to-an-internal-chat-system.md).
- Issuer/entityId compared in one place but used as a lookup key elsewhere, with different normalization [E2](https://bugbountylibrary.com/r/h1%3A976603.md).
- No Audience/AudienceRestriction check, so assertions minted for another SP are accepted [E5](https://bugbountylibrary.com/r/blog%3Ablog-intothesymmetry-com-2017-10-slack-saml-authentication-bypass-html.md).
- Signed-URL/token middleware where an expiry branch returns nil error and short-circuits signature verification [E3](https://bugbountylibrary.com/r/h1%3A2337427.md).
- Protocols signing only headers/body while resource identifiers or HTTP method live in the unsigned URL path [E6](https://bugbountylibrary.com/r/h1%3A348090.md).

## How to review
Identify the exact property: every accepted assertion must have a valid signature over the element whose subject/attributes are consumed, verified against the trusted IdP key, and the verifier and consumer must parse the same bytes. Check that verification is unconditional (no early return, no "if signature present"), that Audience and expiry are enforced, and that issuer/entityId used for auth equals the one used for provisioning after identical normalization. For signed requests, confirm the signature covers method, path and all decision-relevant fields.

## Variants seen
- Missing signature element skips verification entirely [E1](https://bugbountylibrary.com/r/h1%3A136169.md).
- Unsigned assertion accepted at ACS [E4](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-uber-bug-bounty-gaining-access-to-an-internal-chat-system.md).
- Cross-SP assertion reuse due to missing Audience check [E5](https://bugbountylibrary.com/r/blog%3Ablog-intothesymmetry-com-2017-10-slack-saml-authentication-bypass-html.md).
- entityId normalization differential between auth and provisioning [E2](https://bugbountylibrary.com/r/h1%3A976603.md).
- Expiry branch short-circuits signature check on signed URLs [E3](https://bugbountylibrary.com/r/h1%3A2337427.md).
- Unsigned URL path/method reach destructive handlers [E6](https://bugbountylibrary.com/r/h1%3A348090.md).

## Impact and severity
Led to admin/employee account takeover and internal data access [E1](https://bugbountylibrary.com/r/h1%3A136169.md)[E4](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-uber-bug-bounty-gaining-access-to-an-internal-chat-system.md), SSO denial of service and takeover across tenants [E2](https://bugbountylibrary.com/r/h1%3A976603.md), arbitrary file download [E3](https://bugbountylibrary.com/r/h1%3A2337427.md), and destructive identity operations [E6](https://bugbountylibrary.com/r/h1%3A348090.md). Severity is high because a single forged or replayed assertion crosses the user boundary; missing audience and normalization checks widen it to cross-tenant and cross-SP abuse.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A136169.md
- E2: https://bugbountylibrary.com/r/h1%3A976603.md
- E3: https://bugbountylibrary.com/r/h1%3A2337427.md
- E4: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-uber-bug-bounty-gaining-access-to-an-internal-chat-system.md
- E5: https://bugbountylibrary.com/r/blog%3Ablog-intothesymmetry-com-2017-10-slack-saml-authentication-bypass-html.md
- E6: https://bugbountylibrary.com/r/h1%3A348090.md