SSO: One Key to Rule Them All
Single Sign-On (SSO) centralizes authentication, which is both its strength and its risk. A misconfigured SSO implementation can grant attackers access to every connected application with a single compromised session.
12 Common Misconfigurations
1. SAML Signature Wrapping
Manipulating the XML structure to inject unauthorized assertions while keeping a valid signature on the original content.2. Missing Assertion Signature Validation
Accepting unsigned SAML assertions means an attacker can craft any assertion they want.3. OAuth Redirect URI Mismatch
Insufficiently validating redirect URIs:Registered: https://app.example.com/callback
Accepted: https://app.example.com.evil.com/callback
4. PKCE Not Enforced
Authorization Code flow without PKCE is vulnerable to code interception on mobile and public clients.5. Implicit Flow in Production
Tokens exposed in URL fragments, browser history, and referrer headers.6. Missing State Parameter
CSRF attacks on the OAuth flow, potentially linking attacker's account to victim's session.7. Token Scope Over-Provisioning
Requesting more permissions than needed, increasing blast radius of token compromise.8. Missing Token Expiration
Long-lived or non-expiring tokens providing persistent access.9. Insecure Token Storage
Storing tokens in localStorage (vulnerable to XSS) instead of httpOnly cookies.10. IdP Session Fixation
Attacker fixes the IdP session before the victim authenticates, then hijacks the authenticated session.11. Account Linking Vulnerabilities
When SSO is linked to existing accounts without proper verification, attackers can link their SSO identity to a victim's account.12. Logout Propagation Failure
Logging out of one application doesn't terminate the SSO session, leaving other applications accessible.Prevention
- Validate all SAML assertion signatures
- Enforce PKCE for all OAuth flows
- Strictly validate redirect URIs (exact match)
- Implement proper session management and logout propagation
- Regular SSO security assessments
SuperClue SSO Module
SuperClue's SSO configuration module checks what your public sign-in flow exposes and asks for evidence for the rest, and its OAuth module probes OAuth endpoints and tests redirect URI manipulation. It does not test all 12 misconfigurations above, such as SAML signature wrapping.