Cross-site Scripting (XSS)

github.com/crewjam/saml is vulnerable to Cross-site Scripting (XSS). The vulnerability arises from inadequate validation of the ACS location URI in metadata.go, enabling an attacker to register malicious service providers at the IdP. This allows an attacker to inject and execute malicious JavaScript in the ACS endpoint definition, leading to Cross-Site Scripting (XSS) in the IdP context during the redirection at the end of a SAML Single Sign-On (SSO) flow.