Claude AI Finds SAML Security Flaws That Can Let Attackers Take Over Accounts

Key Takeaways

• Anthropic’s Claude AI assisted in discovering critical SAML security flaws across multiple open-source projects.
• The vulnerabilities, including CVE-2026-57580 in Authentik, could lead to full authentication bypass and account takeover.
• The issues stem from inconsistent XML signature processing, parser behavior, and custom SAML code, affecting enterprise single sign-on.
• Patches are available for affected software, with specific mitigation advice for organizations using certain SAML configurations.

Security researchers have leveraged Anthropic’s Claude AI to identify significant vulnerabilities within various Security Assertion Markup Language (SAML) implementations. These critical flaws could enable attackers to bypass authentication mechanisms and seize control of user accounts, underscoring persistent risks associated with XML signature processing, disparate parser behavior, and bespoke SAML code.

An expert at Oblique Security devised an AI-powered testing framework utilizing Claude Opus. This system was designed to scrutinize SAML libraries and applications. Instead of prompting the AI to replicate known vulnerabilities, the setup provided Claude with a threat model, allowing it to independently investigate how different implementations processed signed XML data. This methodology separated the identification of unusual parser behavior from the validation stage, where the AI then attempted to craft functional end-to-end exploits.

Uncovering SAML Weaknesses with AI

SAML is a cornerstone of enterprise single sign-on (SSO), facilitating secure communication where an identity provider transmits signed authentication assertions to a service provider. The integrity of this process, however, hinges on both components interpreting the same XML document identically. Discrepancies between how signature verification and application logic parse XML can create openings for attackers to inject unsigned identity data that the application then erroneously trusts.

The research successfully identified complete authentication bypasses in four distinct projects: Authentik, PHP litesaml/lightsaml, OneUptime, and Java saml-client. In three of these instances, the vulnerability was attributed to SAML signature wrapping. This well-known attack involves an adversary manipulating or injecting XML elements such that a valid signature is verified against one object, while the application subsequently reads identity information from a different, malicious one.

Authentik Flaw Leads to Account Takeover

The most prominent discovery was a critical flaw affecting Authentik, a widely used open-source identity provider. This vulnerability, tracked as CVE-2026-57580, allowed an attacker to embed an XML comment within a SAML NameID value. Under specific non-default account-matching configurations, Authentik could interpret the value preceding the comment as a legitimate victim’s username or email, even as the signed assertion itself remained valid. This could enable an attacker to link a malicious external identity to a victim’s account, thereby establishing a persistent pathway for account takeover.

Authentik promptly addressed this vulnerability in versions 2026.2.6 and 2026.5.5. Organizations utilizing inbound SAML sources configured with USERNAME_LINK or EMAIL_LINK matching are strongly advised to confirm that these updates have been applied. The vendor clarified that default unique-identifier matching and outbound SAML provider deployments were not impacted by this particular flaw.

Broader Implications and Mitigation

The investigation also brought to light weaknesses extending beyond standard SAML login responses. According to Oblique Security research, signature validation bypasses in authentication requests, attribute queries, and logout operations could facilitate information disclosure or arbitrary user logouts. Furthermore, denial-of-service risks were prevalent; several libraries were found to accept attacker-controlled XML documents capable of triggering excessive memory consumption during signature validation or XML transformation. Such vulnerabilities are particularly dangerous as they can often be exploited pre-authentication.

These findings reiterate a crucial message for identity and access management teams: custom SAML implementations should be avoided whenever possible. Developers are urged to prioritize the use of mature, actively maintained libraries, rigorously validate signed elements, disable hazardous XML transformations, enforce document-size and resource limits, and thoroughly test identity workflows for parser differentials and signature wrapping attacks. While AI can significantly accelerate vulnerability discovery, it also starkly reveals the inherent fragility that continues to plague legacy XML-based authentication systems.

What You Should Do

• Update Authentik: Ensure all Authentik instances are updated to versions 2026.2.6, 2026.5.5, or later.
• Review SAML Configurations: Organizations using inbound SAML sources with USERNAME_LINK or EMAIL_LINK account-matching modes in Authentik should verify their update status immediately.
• Patch Affected Libraries: Identify and update any other affected SAML libraries (PHP litesaml/lightsaml, OneUptime, Java saml-client) to their latest secure versions.
• Avoid Custom SAML: Prioritize using well-maintained, mature SAML libraries over custom implementations.
• Implement Robust Validation: Ensure strict validation of signed elements, disable dangerous XML transforms, and enforce document-size and resource limits in all SAML implementations.
• Conduct Regular Audits: Periodically test identity flows for parser differentials and signature wrapping attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.