As Senior AppSec Engineer at Duo, Kelby specializes in secure code review, web application testing, cryptography and low-friction methods of shipping secure software. Prior to Duo, Kelby worked as an AppSec Engineer at Praetorian finding vulnerabilities within software produced by Fortune 500 companies and venture-backed startups. Kelby holds a BS in Computer Science from the University of Texas at Austin.
This blog post describes a new vulnerability class that affects SAML-based single sign-on (SSO) systems. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim user’s password.
