wpscanteam/wpscan · error · WPScan::Error::SAMLAuthenticationFailed

SAML authentication is required to access this resource…

Error message

SAML authentication is required to access this resource. Please ensure correct authentication credentials.

What it means

Raised by Core#handle_saml_authentication (app/controllers/core.rb:112) when the target redirects to a SAML IdP (SAMLRequest in the effective URL or any Location header of the redirect chain) while a manual --cookie-string was supplied without --expect-saml. WPScan treats the supplied cookies as your chosen authentication mechanism; since they evidently did not bypass the SAML redirect, it fails instead of silently overriding your explicit cookies with an interactive login.

Solutions

Log into the site in a browser, copy the complete current Cookie header (all name=value pairs), and re-run with the fresh --cookie-string
Add --expect-saml (keeping --cookie-string) so WPScan performs a headless-browser interactive login instead of relying on the stale cookies
If manual cookies cannot work, drop --cookie-string entirely and authenticate via --expect-saml only

Example fix

# before
wpscan --url https://target --cookie-string 'PHPSESSID=abc123'
# => SAML authentication is required ... Please ensure correct authentication credentials.

# after
wpscan --url https://target --cookie-string 'PHPSESSID=abc123' --expect-saml

Defensive patterns

Strategy: validation

Validate before calling

# Verify manual cookies actually bypass the SAML redirect before scanning
res = Typhoeus.get('https://target', headers: { Cookie: cookie_string }, followlocation: false)
saml_redirect = res.headers['Location'].to_s.match?(/SAMLRequest/i)
abort 'cookies stale: refresh --cookie-string or use --expect-saml' if saml_redirect

Try / catch

begin
  scan.run
rescue WPScan::Error::SAMLAuthenticationFailed
  abort 'refresh --cookie-string from a logged-in browser, or add --expect-saml'
end

Prevention

Copy the entire Cookie request header from a logged-in session, not a single cookie
Re-copy cookies immediately before the scan — SAML sessions expire quickly
Prefer --expect-saml interactive auth for SAML-protected targets
Never hardcode session cookies in CI; they rotate

When it happens

Trigger: A scan with `--cookie-string 'session=...'` against a SAML-protected site where the cookies are stale, incomplete, or copied from a logged-out browser: Core#saml_request? still finds a SAMLRequest, ParsedCli.cookie_string is set, and ParsedCli.expect_saml is falsy.

Common situations: Session cookie expired between copying it from the browser and running the scan; only part of the session cookies copied; IdP session timed out so a fresh SAML round is forced; CI automation with a hardcoded cookie value that rotated.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/5c74c48921ef8b37. Report an issue: GitHub.

Appendix: source

Thrown at app/controllers/core.rb:112

        return true if effective_uri.to_s.match?(/[?&]SAMLRequest/i)

        # SAML flows often bounce through intermediate pages before the IdP;
        # walk the redirect chain to catch a SAMLRequest in any Location header.
        !!homepage_res&.redirections&.any? do |redirect_response|
          redirect_response.headers['Location']&.match?(/SAMLRequest/i)
        end
      end

      # Drives an interactive SAML login via a headless browser, injects the
      # resulting session cookies into the shared Browser, and clears the target's
      # cached homepage so the rest of the scan runs against the authenticated session.
      #
      # @param [ Addressable::URI ] effective_uri  URL that triggered the SAML redirect
      #
      # @return [ Void ]
      def handle_saml_authentication(effective_uri)
        raise Error::SAMLAuthenticationFailed if WPScan::ParsedCli.cookie_string && !WPScan::ParsedCli.expect_saml
        raise Error::SAMLAuthenticationRequired unless WPScan::ParsedCli.expect_saml

        new_cookies = BrowserAuthenticator.authenticate(effective_uri.to_s)

        browser = WPScan::Browser.instance
        browser.cookie_string = [browser.cookie_string, new_cookies].compact.reject(&:empty?).join('; ')

        # Discard the pre-auth homepage so subsequent finders refetch with the new cookies.
        target.reset_homepage_cache!

        @saml_authenticated = true
      end

      # Checks for redirects; an out-of-scope redirect raises Error::HTTPRedirect.
      #
      # @param [ Typhoeus::Response ] res
      def handle_redirection(res)
        effective_url = target.homepage_res.effective_url # get and follow location of target.url

View on GitHub (pinned to 62c9cef471)