There’s a serious bug in the current implementation of SAML authentication which allows an unauthenticated attacker to log into any existing user account without a password.
iPROS24
Exercises in web development
Blog Archives
SuiteCRM – Broken SAML Authentication
Notes on how to migrate SimpleSAMLphp IdP configuration to newer PHP SAML Toolkit version. SLO patch for SuiteCRM-7.8.18 LTS.
