Exam CISSP topic 1 question 194 discussion

B. Attacker forges requests to authenticate as a different user.

By spoofing a registered account and querying the SAML provider, the attacker can forge requests to authenticate as a different user and potentially gain unauthorized access to sensitive data or systems.

The MOST common attack leveraged against this flaw would be the attacker forging requests to authenticate as a different user (option B). This type of attack is known as a SAML spoofing attack, where the attacker is able to impersonate a legitimate user by sending a forged SAML assertion to the cloud service. This can allow the attacker to gain unauthorized access to resources within the security domain.

This is a silver ticket attack.

There is privilege escalation issues through SAML response tampering. https://www.mcafee.com/blogs/enterprise/pentesters-can-take-advantage-weakness-saml/