23/09/2026
Cybersecurity Insights
Publication of a security audit report performed on Shibboleth
Our internal Security Evaluation Laboratory conducted recently a security audit of Shibboleth. This audit aim was to assess the security level of the identification and authentication capabilities of Shibboleth, mainly targeting SAML, OpenIDConnect and Multi-Factor authentication, focusing on code source analysis and dynamic testing and analysis of the authentication mechanisms.
This audit was aiming the Shibboleth Identity Provider 5.1.6 and Service Provider 3.5.1, deployed on Rocky Linux from official archives downloaded from Shibboleth and running on Java Tomcat. The Identity Provider is connected to an LDAP server; the Service Provider being used by two applications for their authentication.
The audit targeted Shibboleth in its deployment environment, thus some findings and recommendations provided in the report may target a broader environment than just Shibboleth.
This security audit was funded by the French cybersecurity agency (ANSSI) as part of its efforts to support the security assessment of open source software (more info here).
During the installation phase, the audit revealed a first problem regarding the size and the difficulty in installing the product, added to a lot of configuration files and a lack of security documentation provided by the developer. The more complex a product is, the easier it is to put it in an unsafe state. Thus, administrators should be careful and take time to think about both functionality, security and in-depth defense.
The static analysis also revealed that the products use outdated COTS, those that are not maintained are not problematic right now, but administrator must keep an eye on this and update them. Especially for the library xerces-c, which is a parsing library, written in C++, accessible by everyone on a network is such a good entry point.
Dynamic Analysis has shown that SAML is very well implemented with metadata verified, completely signed SAML payload. But for OpenIDConnect, as the exchanged metadata are minimalistic, the evaluator expresses doubt about the capacity for an RP to be sure that he is talking to the good IdP. In this audit, the Relying Party was independent from Shibboleth so not evaluated. This was the mod_oidc Apache module, and the evaluator managed to usurp IdP identity and authenticate to the mod_oidc module with his own fake IdP. In production, it should be verified that the OIDC client (the RP) is authenticating the OIDC provider in a more secure way.
Attacks on the MFA revealed that it is brute forcible, due to its minimal size (1000000 possibilities). This brute-force is easy to perform and makes the MFA useless.
A little more fact that can be easily corrected is that an attacker can enumerate user accounts because of an error message displayed during the connection.
In conclusion, it appears that some of those points are quite problematic, but the product can be installed in a secure way. No vulnerabilities were found in the SAML Authentication Request Protocol and it seems to be the more secure way to authenticate. An MFA can also be implemented, even if it is a brute forcible, it’s an additional layer of protection.
At the end of this audit the report was shared with ANSSI and Shibboleth, with nine recommendations designed to Shibboleth or final administrators.
ALMOND and ANSSI decided to share a public version of the audit report to improve the security and transparency of this process, following a responsible disclosure process to Shibboleth.
If you want to find out more about the security audit or evaluation capabilities of our SEAL, feel free to reach us.
If you would like more information about ANSSI’s efforts to support open‑source security, please send an email to opensource@ssi.gouv.fr.
Responsible disclosure timeline
- 2025/12/09: Audit kickoff
- 2026/05/26: Audit final meeting
- 2026/05/28: Final audit report sent to ANSSI
- 2026/06/08: Report shared to Shibboleth by ANSSI
- 2026/06/18: Public version of the audit shared to ANSSI
- 2026/06/29: Shibboleth replied with comments on all vulnerability, findings and recommendations
- 2026/07/03: Final public version of the report
- 2026/09/23: Publication of the joint ALMOND & ANSSI blog posts and audit report
