{"id":"e56fccb3-df46-41fb-98a0-b3e6eb1716f9","task":"Harden SAML 2.0 service provider against XML signature wrapping and related attacks","domain":"cheatsheetseries.owasp.org","steps":["Validate the XML schema of the SAML Response before any signature verification; reject documents that fail schema validation — do not pass malformed XML to the signature verifier","Verify that the Signature element's Reference URI points to the Assertion being validated; check that the ID attribute of the validated element matches the Reference URI exactly, and that only one Assertion is signed","Use a StaticKeySelector seeded with the IdP's certificate (fetched via metadata and pinned locally) rather than trusting KeyInfo in the received document — an attacker can inject a KeyInfo with their own key","After signature verification, extract data from the same element node that was verified — many vulnerabilities arise from verifying one node and reading data from a different node injected by the attacker","Enable ForceAuthn and validate AuthnInstant recency to prevent replay attacks; maintain a used-assertion cache indexed by the Assertion ID to detect duplicate submissions","Keep the SAML library dependency current; CVE-2025-47949 (samlify < 2.10.0) and Ruby-SAML CVEs (CVE-2025-66568/66567 in versions prior to 1.18.0) are active signature wrapping vulnerabilities from 2025"],"gotchas":["ID attributes in XML must be registered with the parser as type ID for ID-based dereferencing to work correctly; parsers that treat ID attributes as plain strings can be fooled by attacker-injected elements with the same string value","Canonicalization algorithm selection matters: the signed content is the canonicalized form of the element; if your verifier canonicalizes differently from the signer, legitimate assertions will fail verification","IdP-initiated SAML flows bypass ForceAuthn controls and are harder to protect against replay; prefer SP-initiated flows for sensitive operations and validate RelayState to prevent open-redirect attacks"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/e56fccb3-df46-41fb-98a0-b3e6eb1716f9"}