SAML: Impersonation and Authentication Bypass Vulnerabilities

SAML vulnerabilities affecting multiple implementations have been discovered [1].

• CVE-2017-11427, CVE-2017-11428, CVE-2017-11429, CVE-2017-11430, CVE-2018-0489, CVE-2018-7340
  These vulnerabilities may allow impersonation or authentication bypass when using an affected SAML implementation. The attack exploits the way certain implementations perform XML canonicalization/parsing in order to manipulate the parsed NameID in SAML assertions. The Airlock IAM SAML implementation is not affected, since such attempts to change the NameID result in an invalid NameID and thus the whole assertion is rejected.