AIKIDO-2025-10956

TL;DR

Affected versions of this package are vulnerable to SAML signature validation bypass due to fallback parsing and response patching that accepted unsigned or forged assertions, where attackers could exploit this by crafting malicious SAML responses without valid signatures to gain unauthorized access, as the vulnerability stemmed from regex-based NameID extraction and status success patching in callbackSSOSAML and ACS endpoints that bypassed strict signature checks.