{"record":{"id":"5c74c48921ef8b37","repo":"wpscanteam/wpscan","slug":"saml-authentication-is-required-to-access-this-res","errorCode":null,"errorMessage":"SAML authentication is required to access this resource. Please ensure correct authentication credentials.","messagePattern":"SAML authentication is required to access this resource\\. Please ensure correct authentication credentials\\.","errorType":"exception","errorClass":"WPScan::Error::SAMLAuthenticationFailed","httpStatus":null,"severity":"error","filePath":"app/controllers/core.rb","lineNumber":112,"sourceCode":"\n        return true if effective_uri.to_s.match?(/[?&]SAMLRequest/i)\n\n        # SAML flows often bounce through intermediate pages before the IdP;\n        # walk the redirect chain to catch a SAMLRequest in any Location header.\n        !!homepage_res&.redirections&.any? do |redirect_response|\n          redirect_response.headers['Location']&.match?(/SAMLRequest/i)\n        end\n      end\n\n      # Drives an interactive SAML login via a headless browser, injects the\n      # resulting session cookies into the shared Browser, and clears the target's\n      # cached homepage so the rest of the scan runs against the authenticated session.\n      #\n      # @param [ Addressable::URI ] effective_uri  URL that triggered the SAML redirect\n      #\n      # @return [ Void ]\n      def handle_saml_authentication(effective_uri)\n        raise Error::SAMLAuthenticationFailed if WPScan::ParsedCli.cookie_string && !WPScan::ParsedCli.expect_saml\n        raise Error::SAMLAuthenticationRequired unless WPScan::ParsedCli.expect_saml\n\n        new_cookies = BrowserAuthenticator.authenticate(effective_uri.to_s)\n\n        browser = WPScan::Browser.instance\n        browser.cookie_string = [browser.cookie_string, new_cookies].compact.reject(&:empty?).join('; ')\n\n        # Discard the pre-auth homepage so subsequent finders refetch with the new cookies.\n        target.reset_homepage_cache!\n\n        @saml_authenticated = true\n      end\n\n      # Checks for redirects; an out-of-scope redirect raises Error::HTTPRedirect.\n      #\n      # @param [ Typhoeus::Response ] res\n      def handle_redirection(res)\n        effective_url = target.homepage_res.effective_url # get and follow location of target.url","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/core.rb#L94-L130","documentation":"Raised by Core#handle_saml_authentication (app/controllers/core.rb:112) when the target redirects to a SAML IdP (SAMLRequest in the effective URL or any Location header of the redirect chain) while a manual --cookie-string was supplied without --expect-saml. WPScan treats the supplied cookies as your chosen authentication mechanism; since they evidently did not bypass the SAML redirect, it fails instead of silently overriding your explicit cookies with an interactive login.","triggerScenarios":"A scan with `--cookie-string 'session=...'` against a SAML-protected site where the cookies are stale, incomplete, or copied from a logged-out browser: Core#saml_request? still finds a SAMLRequest, ParsedCli.cookie_string is set, and ParsedCli.expect_saml is falsy.","commonSituations":"Session cookie expired between copying it from the browser and running the scan; only part of the session cookies copied; IdP session timed out so a fresh SAML round is forced; CI automation with a hardcoded cookie value that rotated.","solutions":["Log into the site in a browser, copy the complete current Cookie header (all name=value pairs), and re-run with the fresh --cookie-string","Add --expect-saml (keeping --cookie-string) so WPScan performs a headless-browser interactive login instead of relying on the stale cookies","If manual cookies cannot work, drop --cookie-string entirely and authenticate via --expect-saml only"],"exampleFix":"# before\nwpscan --url https://target --cookie-string 'PHPSESSID=abc123'\n# => SAML authentication is required ... Please ensure correct authentication credentials.\n\n# after\nwpscan --url https://target --cookie-string 'PHPSESSID=abc123' --expect-saml","handlingStrategy":"validation","validationCode":"# Verify manual cookies actually bypass the SAML redirect before scanning\nres = Typhoeus.get('https://target', headers: { Cookie: cookie_string }, followlocation: false)\nsaml_redirect = res.headers['Location'].to_s.match?(/SAMLRequest/i)\nabort 'cookies stale: refresh --cookie-string or use --expect-saml' if saml_redirect","typeGuard":null,"tryCatchPattern":"begin\n  scan.run\nrescue WPScan::Error::SAMLAuthenticationFailed\n  abort 'refresh --cookie-string from a logged-in browser, or add --expect-saml'\nend","preventionTips":["Copy the entire Cookie request header from a logged-in session, not a single cookie","Re-copy cookies immediately before the scan — SAML sessions expire quickly","Prefer --expect-saml interactive auth for SAML-protected targets","Never hardcode session cookies in CI; they rotate"],"tags":["saml","authentication","cookies","session-expired"],"backgroundTag":"saml-authentication-failed","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}