AIKIDO-2026-897044

TL;DR

The Microsoft.IdentityModel.Tokens.Saml component reads SAML security tokens and assertions from request input. A crafted SAML token drives a loop whose exit condition is never reached while deserializing untrusted data, so processing never completes. Before the fix an unauthenticated caller can send such a token over the network to exhaust CPU and memory and stop the service from answering legitimate requests. The fix corrects the loop so parsing terminates and the malformed token is rejected instead of looping indefinitely.