Alvaro Muñoz - SSO Wars: The Token Menace

SSO Wars: Attacking Single Sign-On

Alvaro Muñoz (Principal Security Researcher, GitHub Security Lab) presents a comprehensive attack taxonomy against enterprise Single Sign-On (SSO) implementations, demonstrating how identity federation protocols are systematically misimplemented.

SAML Vulnerabilities

The talk covers XML Signature Wrapping (XSW) attacks, where attackers inject a valid signature into an unsigned forged assertion without invalidating the cryptographic check. Muñoz demonstrates multiple XSW variants that bypass authentication in real-world SP implementations.

OAuth 2.0 and OIDC Attack Surface

Common OAuth misconfigurations including open redirectors, insufficient state parameter validation, and CSRF in authorization endpoints allow account takeover without any cryptographic break. The talk covers code injection via redirect_uri manipulation.

JWT Pitfalls

Muñoz documents the 'alg:none' attack, RSA/HMAC confusion attacks, and weak secret brute-forcing against JWT implementations, providing tooling and detection strategies.