Claude Opus broke four SAML libraries in a month

A security researcher pointed an agent harness built on Claude Opus at every SAML implementation available and came away with full authentication bypasses in four projects and signature bypasses in twelve more. The work ran across roughly a month of spare time and is described in a writeup published by Oblique.

At a glance

• Feeding the model a corpus of known SAML bugs mostly produced hunts for copies of those same bugs in other libraries; supplying a threat model and letting it explore worked better.
• The pipeline ran in two phases, a gadget phase for odd library behaviour and a findings phase that wrote end-to-end exploits, with results stored as JSONL and out-of-scope items dropped early.
• Eight researchers independently filed the Authentik bug at the same time, and almost every major SAML library proved vulnerable to out-of-memory conditions triggered by unauthenticated requests.

The result reads less as a break in SAML itself than as a map of how thin its implementation layer is: the protocol survived, individual libraries did not. Cheap, exhaustive agentic scanning appears to shift the economics of protocol criticism, since a claim that a design is dangerous can now be backed by concrete CVEs rather than anecdotes. The cost of that shift lands on library maintainers rather than on the protocol's designers.

The pipeline ran on a Claude Max 20x plan with account guardrails lifted

Access came through Anthropic's Cyber Verification Program, which the researcher applied to in order to have guardrails removed from the account. After acceptance, an Opus model wrote exploits from a supplied corpus of prior research and prompting, with the work running on a Claude Max 20x plan.

The harness followed the same primitives as other public hacking harnesses: split work across multiple agents, store intermediate results that agents use for direction, and prioritise, scope and deduplicate the queue. One logged gadget, catalogued as g-0005, records Node's xml-crypto flattening XML processing instructions to their bare text during canonicalisation, which the findings phase turned into an email truncation bypass. The harness code is published as oblique-security/saml-research.

Four projects fell to full authentication bypasses, one tracked as CVE-2026-57580

In Authentik, a comment injected into the NameID field truncates the value to another user's account and authenticates as that user, tracked as CVE-2026-57580. The PHP library litesaml/lightsaml (CVE-2026-63182), OneUptime (issue 2949) and Java's saml-client (issue 149) each fell to signature wrapping on the Response message.

That cadence is not new. Since 2020 a bypass has surfaced in a major SAML library roughly once a quarter, and GitHub Enterprise alone accumulated four across 2024 and 2025 (CVE-2024-4985, CVE-2024-6800, CVE-2024-9487, CVE-2025-23369). Most trace to components interpreting XML in subtly different ways and processing unsigned data as if it were verified.

Signatures on AuthnRequest, AttributeQuery and LogoutRequest attract far less scrutiny than the Response message, and the harness found bypasses there in twelve projects and counting, producing information disclosure and arbitrary logouts. One of those has been publicly reported in the TypeScript project samlify.

Go patches landed while Python and Node denial-of-service issues stay open

The denial-of-service surface follows from SAML requiring arbitrary XML posted over the internet. Go's xmldsig allocated memory quadratically during signature validation because of a missing check, and JavaScript's xmldom triggers similar allocations across Node libraries. Python packages pass unfiltered transforms to libxmlsec1, so a recursive XSLT template can expand a document arbitrarily.

OneUptime, which has leaned on AI in its own development, went through three rounds: a public issue on multiple signature bypasses (2949) was followed by a large merged pull request the same day, then a bypass via a signed error response (2981), then one using an XML processing instruction to modify the NameID (2988). After the third round, the fixes appeared to hold.

One company that received a report asked for a screen recording to filter out AI-generated submissions. The researcher refused, and the issue was still fixed and assigned a CVE, though maintainers are now absorbing both genuine and generated reports at volume.

The xmldom report stays private The Node-side xmldom issue has not been made public, and the Python and Node denial-of-service problems remain open with no fix timeline given. The researcher stopped for lack of appetite for such reports rather than lack of bugs, and recommends running an LLM evaluation against any SAML integration; the closing advice is blunter, which is to use OpenID Connect and not hand-roll SAML.