diff --git a/src/pentesting-web/saml-attacks/README.md b/src/pentesting-web/saml-attacks/README.md
index ddefd559a46..dd5035873fd 100644
--- a/src/pentesting-web/saml-attacks/README.md
+++ b/src/pentesting-web/saml-attacks/README.md
@@ -223,6 +223,30 @@ You can also use the Burp extension [**SAML Raider**](https://portswigger.net/ba
 
 With the signatures removed, allow the request to proceed to the target. If the Signature isn’t required by the Service
 
+## Fail-open SAML verification in unconfigured SSO handlers
+
+Some products keep the **SAML authentication endpoint reachable even when SSO was never configured**. If a constructor or config-loading error leaves security fields at language defaults such as `""` or `false`, the unconfigured path can become **less secure** than the configured one.<sup>[[14]](#references)</sup>
+
+### What to test
+
+- Reach the SAML ACS / login handler while SSO is **disabled**, **never configured**, or after deleting its config. The handler should fail closed before parsing attacker-controlled XML.
+- Check whether missing configuration skips initialization of fields such as the **signature verification mode**, **trusted issuer**, **audience**, **certificate path**, or **local-user policy**, while request processing still continues.
+- Look for **fail-open mode checks** such as `if mode in {response, assertion, both} verify_signature(...)` with **no rejecting `else`**. An empty / malformed mode can silently disable both response- and assertion-signature verification.
+- Compare **presence checks** with **normalized comparisons**. A whitespace-only `<Issuer>` can satisfy `issuer != null`, then be trimmed to `""` and match an empty configured issuer.
+- If time validation only runs when `<Conditions>` exists, try **omitting `Conditions` entirely** instead of forging timestamps.
+
+### Exploitation notes
+
+Once verification is bypassed, a **schema-valid but unsigned** `SAMLResponse` containing `Status=Success`, at least one `Assertion`, and an attacker-chosen `NameID` may be enough to authenticate as an arbitrary existing federated user.<sup>[[14]](#references)</sup>
+
+Practical details to check:
+
+- Some implementations accept the **first assertion** that passes local checks and ignore the rest.
+- If local usernames are blocked but values containing `\` or `@` are allowed, target an existing **directory identity** such as `DOMAIN\Administrator` or `user@domain`.
+- The forged value still needs to survive **account-resolution / canonical-name** checks performed after SAML parsing.
+
+A recent example of this pattern is the Synology DS925+ SAML SSO bypass documented by Chanze Lee.
+
 ## Certificate Faking <a href="#certificate-faking" id="certificate-faking"></a>
 
 ## Certificate Faking
@@ -471,5 +495,6 @@ The same parser weakness that gives an overread can also crash the SAML processi
 - [11] [Securing XML implementations across the web](https://mattermost.com/blog/securing-xml-implementations-across-the-web/)
 - [12] [SAML is insecure by design](https://joonas.fi/2021/08/saml-is-insecure-by-design/)
 - [13] [On Breaking SAML: Be Whoever You Want to Be (USENIX Security 2012)](https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf)
+- [14] [Pwn2Own Ireland 2025: Bypassing Authentication via Synology DS925+ SAML SSO](https://chanzep.github.io/posts/pwn2own-ireland-2025-bypassing-authentication-via-synology-ds925-saml-sso)
 
 {{#include ../../banners/hacktricks-training.md}}