New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems

Researchers have disclosed a new attack technique called Silver SAML that can bypass defenses against Golden SAML attacks. It enables the exploitation of SAML for launching attacks against applications like Salesforce. Silver SAML works with Microsoft Entra ID and doesn't require access to the Active Directory Federation Services (AD FS). Microsoft has been notified about the issue and organizations are advised to use Entra ID self-signed certificates for SAML signing.