CVE-2023-45683

github.com/crewjam/saml is a saml library for the go language. In affected
versions the package does not validate the ACS Location URI according to
the SAML binding being parsed. If abused, this flaw allows attackers to
register malicious Service Providers at the IdP and inject Javascript in
the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the
IdP context during the redirection at the end of a SAML SSO Flow.
Consequently, an attacker may perform any authenticated action as the
victim once the victim’s browser loaded the SAML IdP initiated SSO link for
the malicious service provider. Note: SP registration is commonly an
unrestricted operation in IdPs, hence not requiring particular permissions
or publicly accessible to ease the IdP interoperability. This issue is
fixed in version 0.4.14. Users unable to upgrade may perform external
validation of URLs provided in SAML metadata, or restrict the ability for
end-users to upload arbitrary metadata.