2026-09-23 digest

Trail of Bits calls SAML a fractal of bad design and argues for OIDC only

Security discussion

  • Sources: primary, discussion
  • Summary: Trail of Bits published an argument that service providers should drop SAML in favor of OIDC. The post traces XML signature wrapping and canonicalization bugs from 2012 through 2025. It sets out a migration path for service providers.
  • Why it matters: A team that owns a service provider integration now has a vendor-published argument to cite when it proposes retiring SAML support.

send feedback on this story