Executive Lead & Threat Context

Amazon Web Services (AWS) has resolved a critical cross-account privilege escalation vulnerability (CVE-2026-78520, CVSS 9.1) residing within AWS IAM Identity Center (formerly AWS Single Sign-On). The flaw enabled an authenticated user belonging to an external identity provider (IdP) such as Okta, Ping Identity, or Microsoft Entra ID to forge SAML assertion attributes, assuming elevated administrative permission sets across unrelated accounts in an AWS Organization.

Because IAM Identity Center acts as the centralized access gate for multi-account enterprise cloud architectures, successful exploitation allowed an adversary to bridge organizational security boundaries and obtain full AdministratorAccess credentials via AWS Security Token Service (STS).

Vulnerability Mechanics & XML Canonicalization Breakdown (CWE-287 / CWE-611)

When federating access into AWS, the client browser delivers a signed base64-encoded SAML 2.0 response to the IAM Identity Center assertion consumer service (ACS) endpoint. The response includes an containing the user's email address and mapped IAM role ARNs.

Security researchers discovered that IAM Identity Center's assertion verification engine and its subsequent role-mapping processor utilized disparate XML parsers. Specifically, while the cryptographic signature validator performed standard Exclusive XML Canonicalization (C14N), the role extraction layer truncated strings containing raw XML comment nodes (e.g., ) within attribute values. By injecting a comment sequence between an unprivileged username and an administrative role alias, an attacker could induce the processor to match against an administrative permission set:

<saml2:Attribute Name="https://aws.amazon.com/SAML/Attributes/Role">
  <saml2:AttributeValue>
    arn:aws:iam::123456789012:role/DeveloperUser<!--admin-split-->arn:aws:iam::987654321098:role/AWSReservedSSO_AdministratorAccess_1a2b3c4d
  </saml2:AttributeValue>
</saml2:Attribute>

Because the identity provider signed the entire XML block without rejecting comments, the digital signature passed verification. The role mapping module, however, parsed the comment delimiter as an array separator, issuing an STS token for the target enterprise's root management account.

Remediation Matrix & Cloud Defense Playbook

AWS has automatically deployed server-side parser fixes across all global regions. Enterprise cloud architects should perform the following security checks:

Platform Component Vulnerability Exposure Remediation Action
AWS IAM Identity Center ACS All regions prior to patch deployment Managed fix deployed globally by AWS
Self-Managed Shibboleth / Keycloak Custom SAML brokers passing raw comments Enforce strict XML schema validation
  1. CloudTrail Historical Audit: Query AWS CloudTrail logs for anomalous AssumeRoleWithSAML events where the principalId contains unexpected punctuation or non-standard email syntaxes.
  2. Enforce Service Control Policies (SCPs): Implement organization-level SCPs that explicitly deny sts:AssumeRoleWithSAML requests from IP addresses outside authorized corporate VPN CIDRs.
  3. Least-Privilege Permission Set Scoping: Review IAM Identity Center permission sets, ensuring multi-account administrator roles require step-up session verification and session durations are capped at 1 hour.