# SAML XML signature wrapping attack: attacker injects malicious assertions that bypass signature validation

- **ID:** `security/saml-xml-signature-wrapping-bypass`
- **Domain:** security
- **Category:** protocol_error
- **Error Code:** `SAML_SIGNATURE_WRAPPING`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

SAML response parser validates the signature on the original assertion but processes a different, unsigned assertion injected via XML wrapping (e.g., using ID duplication or SOAP envelope manipulation), allowing attacker-controlled attributes.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OpenSAML 4.3.0 | active | — | — |
| Shibboleth IdP 4.3.0 | active | — | — |
| SimpleSAMLphp 1.19.0 | active | — | — |
| Microsoft AD FS 2019 | active | — | — |
| Okta SAML 1.0.0 | active | — | — |

## Workarounds

1. **Enforce strict assertion ID uniqueness and reject responses with duplicate IDs. Example in Java using OpenSAML: set `strictValidation=true` and configure `IdAttributeResolver` to check for duplicates.** (90% success)
   ```
   Enforce strict assertion ID uniqueness and reject responses with duplicate IDs. Example in Java using OpenSAML: set `strictValidation=true` and configure `IdAttributeResolver` to check for duplicates.
   ```
2. **Use a whitelist of allowed assertion IDs or require that the signed assertion is the only one processed, ignoring any wrapped content.** (85% success)
   ```
   Use a whitelist of allowed assertion IDs or require that the signed assertion is the only one processed, ignoring any wrapped content.
   ```

## Dead Ends

- **** — Attackers can place the malicious assertion before the signed one; parser may process the first unsigned assertion. (85% fail)
- **** — Wrapping attacks use well-formed XML that passes schema validation; the attack is structural, not syntactic. (75% fail)
- **** — Attackers can sign the malicious assertion with a stolen or self-signed certificate if the trust store is misconfigured. (80% fail)