Oblique Security

Claude Discovers Vulnerabilities Across 16 SAML Projects in One Month, Exposing Maintenance Gaps

Security researcher Eric Chiang used Anthropic's Claude Opus model to identify vulnerabilities in 16 SAML implementations over roughly one month of evening work. The effort uncovered four full authentication bypasses in projects including Authentik, lightsaml, OneUptime, and saml-client, plus twelve additional signature bypass issues affecting secondary protocol messages. A notable finding was CVE-2026-57580 in Authentik, independently reported by eight researchers, which allowed XML comment injection in the NameID field to hijack accounts under specific configuration settings. Chiang built a two-phase agent pipeline that first searched for behavioral anomalies in libraries and then combined them into working exploits, without needing to train the model on prior SAML vulnerabilities. Many maintainers either ignored reports or struggled to distinguish real issues from AI-generated noise, with one project requiring three iterations of fixes before the patches held. The researcher concluded that while discovering SAML flaws has become inexpensive, patching them remains costly and under-resourced, reinforcing his long-standing recommendation to avoid custom SAML code in favor of established libraries or OpenID Connect.