Our response to four SAML vulnerabilities, from report to remediation

In late September 2026, we fixed four SAML SSO authentication bypasses where signature verification and identity extraction could disagree on the same response. This post covers the root cause, our response, and guidance for developers who process signed XML.