SAML Response Signature Exclusion

Severity: High

Invicti detected that the target application is vulnerable to SAML Response Signature Exclusion.

The web application uses SAML. The web application's SAML Consumer Service doesn't check a SAML Response signature when the Signature element is removed. An authenticated attacker may be able to use it to escalate privileges to a highly privileged user or to takeover accounts of other users in the application.


Account takeover and/or privilege escalation


Change the configuration of the SAML service to require a valid signature for SAML Response.

Invicti Logo

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo