vulns.co
/
mcp by GKData.io

Back to Gadgets

SAML ACS / recipient confusion

SSO XML that is trusted more than the HTTP layer. Recipient, Audience, Destination, and XML wrapping are the gadgets. Pair with XXE on the same parser.

Tags: saml, sso, ato, xxe

Typical severity: P1-P2

What it becomes

If the SP accepts an assertion meant for another ACS, or does not bind Recipient / Audience / Destination, you mint a session.

Where to look

  • ACS URL
  • IdP-initiated SSO
  • multi-tenant SSO
  • old OneLogin/Okta/ADFS integrations

Chains

  • ATO: Replay or re-target an assertion at a different ACS or tenant that still verifies the signature.
  • Account linking: Email claim from the IdP overwrites a local account with no verification.
  • XXE: The same XML parser that verifies the assertion may still load a DTD.

Notes

  • Test only on an IdP and SP you control, or a program that gives you a test tenant.
  • Signature wrapping is a parser bug. Golden SAML is an IdP key leak. Do not mix the reports.

Back to Gadgets