Saml authentication bypass vulnerability