# SAML roulette: the hacker always wins

DevFeed: [SAML roulette: the hacker always wins](<https://devfeed.tech/articles/saml-roulette-the-hacker-always-wins-7696.md>)

Original publisher: [Read original article](<https://portswigger.net/research/saml-roulette-the-hacker-always-wins>)

Author: Gareth Heyes

Published: 2025-03-18T14:55:43Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [GitLab](<https://devfeed.tech/topics/gitlab.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [XML](<https://devfeed.tech/topics/xml.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Ruby](<https://devfeed.tech/topics/ruby.md>), [Library](<https://devfeed.tech/topics/library.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [github](<https://devfeed.tech/tags/github.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [library](<https://devfeed.tech/tags/library.md>), [research](<https://devfeed.tech/tags/research.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [xml](<https://devfeed.tech/tags/xml.md>)

## AI overview

This security research post explains how round-trip attacks and namespace confusion in the ruby-saml library can be chained to bypass signature verification and obtain unauthenticated administrative access to GitLab Enterprise. It describes parser inconsistencies involving REXML and Nokogiri, XML mutations using comments and CDATA, and a testbed for evaluating SAML libraries. The supplied article text ends during the discussion of DOCTYPE analysis.

## Source excerpt

Introduction In this post, we'll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library