Four SAML implementations fell to a Claude harness

A month of spare-time work with a Claude Opus harness produced full authentication bypasses in four separate SAML implementations, one of them Authentik (CVE-2026-57580). The researcher behind the project published the harness, the exploits and the disclosure history in a write-up on Oblique.

At a glance

• The harness splits work into a gadget phase that hunts odd XML behavior in underlying libraries and a findings phase that chains gadgets together and confirms them with an end-to-end exploit.
• Beyond the four bypasses, twelve projects and counting carry signature bypasses in rarely audited messages such as AuthnRequest, AttributeQuery and LogoutRequest, producing information disclosure and arbitrary logout issues.
• Denial-of-service vectors reached almost every major SAML library: patches for the Go ecosystem were accepted, while Python and Node packages carry active out-of-memory issues that remain unfixed.

The result reads less as a break in SAML than as a measurement of it: the protocol survived structurally, yet bypasses turned up in widely deployed projects. What appears to change is the cost of looking. Exhaustive review across an entire protocol ecosystem, once a research-scale undertaking, now fits inside a month of spare time on a consumer subscription. That shift likely lands hardest on maintainers rather than attackers, since open source projects now field both genuine and machine-generated reports at volume.

Three of the four bypasses came from signature wrapping on the Response message

Authentik was vulnerable to a comment injected into the NameID field, which truncates the value to another user's account and authenticates as that user (CVE-2026-57580). The PHP library litesaml/lightsaml (CVE-2026-63182), OneUptime (issue #2949) and Java's saml-client (issue #149) all accepted signature wrapping on the Response message.

The Authentik issue was reported by eight independent researchers at the same time. Since 2020 a bypass has surfaced in a major SAML library roughly once a quarter, with GitHub Enterprise alone accounting for four across 2024 and 2025: CVE-2024-4985, CVE-2024-6800, CVE-2024-9487 and CVE-2025-23369. Most stem from components interpreting XML in subtly different ways and processing unsigned data as if it had been verified.

A gadget phase and a findings phase write intermediate results to JSONL files

Access came through Anthropic's Cyber Verification Program, which lifted the guardrails on the account and provided an Opus model that would write exploits from the researcher's own SAML research and prompting. The work ran on a Claude Max 20x plan.

Hacking harnesses converge on the same primitives: splitting work between multiple agents, storing intermediate results that agents can steer on, and prioritizing, scoping and deduplicating the queue. One step rejects out-of-scope proposed findings before tokens are spent proving them. The code is published as oblique-security/saml-research.

Feeding Claude a corpus of known vulnerabilities mostly produced hunts for replicas of those exact issues in other libraries, while a threat model plus open exploration worked better. One confirmed gadget covered Node's xml-crypto, where processing instructions canonicalize to their bare data text, which the findings phase turned into an email truncation bypass in NameID.

Python and Node SAML libraries still carry unfixed out-of-memory bugs

SAML requires processing arbitrary XML documents posted over the internet, and almost every major library proved susceptible to out-of-memory conditions from unauthenticated requests. Go's xmldsig allocated memory quadratically during signature validation because of a missing check, and patches for the Go ecosystem were accepted.

JavaScript's xmldom causes similar allocations across all Node libraries, and that report is still private. Python packages do not filter the set of transforms they hand to libxmlsec1, so an XSLT template with recursive expansion can force the library to generate an arbitrarily large document.

One company asked for a screen recording to filter out generated reports; the researcher refused, and the issue was fixed and assigned a CVE on the strength of its impact. At OneUptime, a public issue was followed the same day by a large pull request claiming a fix, and two further bypasses were filed as issues #2981 and #2988 before the patches held.

Which fixes remain open

The Python and Node denial-of-service issues are unfixed, and the xmldom report has not been made public. The twelve signature bypasses in AuthnRequest, AttributeQuery and LogoutRequest handling are described as still counting, with samlify the publicly reported example. The researcher stopped at a chosen point rather than after exhausting the bugs, and recommends avoiding hand-rolled SAML, considering OpenID Connect instead, and running an LLM evaluation against any implementation.