WorkOS Addresses SAML SSO Authentication Bypass Vulnerabilities

• •WorkOS fixed four SAML SSO bypass vulnerabilities reported by Alex Tan.
• •The vulnerabilities allowed attackers to exploit discrepancies in XML parsing.
• •No evidence of exploitation beyond security testing has been found.

Between September 24 and 27, 2026, WorkOS identified and fixed four SAML SSO authentication bypass vulnerabilities reported by security researcher Alex Tan. The vulnerabilities stemmed from a dual-view XML parsing issue, allowing attackers to exploit discrepancies between signature verification and identity extraction. An attacker could use a legitimately signed SAML response to impersonate another user. WorkOS blocked the initial report within approximately 1 hour and 40 minutes and mitigated all identified exploit variants by September 27, 2026. No evidence of exploitation beyond security testing has been found. The incident is distinct from previous SAML vulnerabilities and highlights an engineering architecture problem rather than a configuration error. WorkOS has since implemented structural hardening measures to prevent similar issues in the future.