Golden SAML, Explained: One Stolen Key, Unlimited Accepted Identities

A Golden SAML token is a forged SAML response signed with the real key. It impersonates any user in a federated environment, and it passes because the services on the other end validate the signature, not the person. First reported by CyberArk in 2017, the technique reaches federated services such as email systems and APIs by exploiting the trust relationship between an identity provider and the services that rely on it. As documented in the Sygnia report , it gained its widest visibility during the SolarWinds software supply chain attack. The mechanism runs on a specific chain of events.