SAML Response Without Signature

Summary

Acunetix 360 detected that the target application is vulnerable to a SAML Response without a signature.

The web application uses SAML. The web application's SAML Consumer Service doesn't require SAML Response signature. An authenticated attacker may be able to use it to escalate privileges to a high privileged user or to takeover accounts of other users in the application.

Impact

Account takeover and/or privilege escalation

Remediation

Change the configuration of the SAML service to require a valid signature for SAML Response

Severity

Classification