SAML was created in 2002 by merging four rival XML security protocols into one spec. That design still generates vulnerabilities: a canonicalization flaw via XML comments in 2018, XML round-trip bugs in Go's stdlib in 2020, a GitHub Enterprise SAML auth bypass in 2025, and more.
Matt Schwager breaks down 5 design flaws behind the pattern and makes the case for moving to OIDC.
https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/