SAML Single Sign On – SSO Login Security & Risk Analysis

The "miniorange-saml-20-single-sign-on" plugin presents a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL queries, utilizing prepared statements exclusively. The high percentage of properly escaped output (94%) and a substantial number of nonce and capability checks (13 and 21 respectively) also suggest an effort towards secure coding. However, several areas raise concerns. The presence of one unprotected AJAX handler significantly expands the attack surface, potentially allowing unauthorized actions. While taint analysis did not reveal critical or high severity unsanitized paths, the two flows with unsanitized paths warrant attention, as they could lead to vulnerabilities if exploited. The plugin's history of known CVEs, totaling six, is a notable weakness. Although there are currently no unpatched vulnerabilities, the history includes one high-severity issue and five medium-severity issues across common vulnerability types like missing authorization, open redirects, XSS, and CSRF. This pattern indicates a recurring tendency to introduce security flaws, necessitating vigilant monitoring and prompt patching of future issues. The bundled Select2 library, while not explicitly flagged as outdated, is a potential area for review if specific versions are known to have vulnerabilities.