wpscanteam/wpscan · error · WPScan::Error::SAMLAuthenticationFailed

SAML authentication is required to access this resource. Ple

Error message

SAML authentication is required to access this resource. Please ensure correct authentication credentials.

What it means

Raised by Core#handle_saml_authentication (app/controllers/core.rb:112) when the target redirects to a SAML IdP (SAMLRequest in the effective URL or any Location header of the redirect chain) while a manual --cookie-string was supplied without --expect-saml. WPScan treats the supplied cookies as your chosen authentication mechanism; since they evidently did not bypass the SAML redirect, it fails instead of silently overriding your explicit cookies with an interactive login.

Source

Thrown at app/controllers/core.rb:112

        return true if effective_uri.to_s.match?(/[?&]SAMLRequest/i)

        # SAML flows often bounce through intermediate pages before the IdP;
        # walk the redirect chain to catch a SAMLRequest in any Location header.
        !!homepage_res&.redirections&.any? do |redirect_response|
          redirect_response.headers['Location']&.match?(/SAMLRequest/i)
        end
      end

      # Drives an interactive SAML login via a headless browser, injects the
      # resulting session cookies into the shared Browser, and clears the target's
      # cached homepage so the rest of the scan runs against the authenticated session.
      #
      # @param [ Addressable::URI ] effective_uri  URL that triggered the SAML redirect
      #
      # @return [ Void ]
      def handle_saml_authentication(effective_uri)
        raise Error::SAMLAuthenticationFailed if WPScan::ParsedCli.cookie_string && !WPScan::ParsedCli.expect_saml
        raise Error::SAMLAuthenticationRequired unless WPScan::ParsedCli.expect_saml

        new_cookies = BrowserAuthenticator.authenticate(effective_uri.to_s)

        browser = WPScan::Browser.instance
        browser.cookie_string = [browser.cookie_string, new_cookies].compact.reject(&:empty?).join('; ')

        # Discard the pre-auth homepage so subsequent finders refetch with the new cookies.
        target.reset_homepage_cache!

        @saml_authenticated = true
      end

      # Checks for redirects; an out-of-scope redirect raises Error::HTTPRedirect.
      #
      # @param [ Typhoeus::Response ] res
      def handle_redirection(res)
        effective_url = target.homepage_res.effective_url # get and follow location of target.url

View on GitHub (pinned to 62c9cef471)

Solutions

1. Log into the site in a browser, copy the complete current Cookie header (all name=value pairs), and re-run with the fresh --cookie-string
2. Add --expect-saml (keeping --cookie-string) so WPScan performs a headless-browser interactive login instead of relying on the stale cookies
3. If manual cookies cannot work, drop --cookie-string entirely and authenticate via --expect-saml only

Example fix

# before
wpscan --url https://target --cookie-string 'PHPSESSID=abc123'
# => SAML authentication is required ... Please ensure correct authentication credentials.

# after
wpscan --url https://target --cookie-string 'PHPSESSID=abc123' --expect-saml

# Verify manual cookies actually bypass the SAML redirect before scanning
res = Typhoeus.get('https://target', headers: { Cookie: cookie_string }, followlocation: false)
saml_redirect = res.headers['Location'].to_s.match?(/SAMLRequest/i)
abort 'cookies stale: refresh --cookie-string or use --expect-saml' if saml_redirect

begin
  scan.run
rescue WPScan::Error::SAMLAuthenticationFailed
  abort 'refresh --cookie-string from a logged-in browser, or add --expect-saml'
end

When it happens

Trigger: A scan with `--cookie-string 'session=...'` against a SAML-protected site where the cookies are stale, incomplete, or copied from a logged-out browser: Core#saml_request? still finds a SAMLRequest, ParsedCli.cookie_string is set, and ParsedCli.expect_saml is falsy.

Common situations: Session cookie expired between copying it from the browser and running the scan; only part of the session cookies copied; IdP session timed out so a fresh SAML round is forced; CI automation with a hardcoded cookie value that rotated.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• SAML authentication is required to access this resource. Ple
• SAML authentication is required to access this resource, con
• The API token provided is invalid
• SAML authentication needs an interactive terminal to wait fo
• --expect-saml requires Chrome or Chromium to be installed an

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/5c74c48921ef8b37. Report an issue: GitHub.