RANDE // SECURITY RESEARCH COLLECTIVE

RANDE

RESEARCH/EXPLOITATION/DISCOVERY

We find what shouldn't be findable. Independent vulnerability research and bug bounty work, published only once it's proven — real proof of concept, real impact, no hand-waving.

view the archive→

latest recordsview archive →

SAML Identity Assertion Trust Bypass

Signed, Not Verified

A Test-Drive SSO feature accepts a signed SAML assertion for any identity and JIT-provisions a session for it instantly — no invitation, no verification, no click, and no prior relationship between attacker and target required.

csa6anSep 4, 2026