A write-up of a Synology DS925+ SAML SSO auth bypass, where an empty config quietly turns off signature checks.
4 comments
An empty config turning off signature checks feels like the sort of default that survives way too long. Is that common in appliance SSO setups?
Common enough, especially when unset means permissive, but where's the hardening baseline?
Do these SAML bypasses usually come from the product treating "no config" as a valid mode, or is this more of a one-off bug where the signature check path just never gets reached?
Usually both, but here it looks like a real fallback mode: empty config => no signature check path.