SAML 2.0 (Security Assertion Markup Language 2.0) is a federated authentication protocol that lets an identity provider prove a user’s identity to a service provider. Instead of sending a password to each application, the user signs in once, and the identity provider sends a signed assertion that the service provider trusts if it validates the message correctly.
This matters because SAML sits at the boundary of login trust. If an attacker can forge, replay, or tamper with an assertion, or exploit weak session handling after assertion acceptance, they may gain unauthorized access without knowing the user’s password. In real defenses, teams protect SAML with strict signature validation, audience and timestamp checks, secure certificate management, and careful session creation logic. In attacks, flaws often appear as authentication bypasses, misconfigured trust relationships, or incorrect handling of the older SSO path versus a newer interface.