SSO
Single Sign-On. A user authenticates once and gains access to multiple applications without re-entering credentials. Implemented with SAML or OIDC in modern deployments. Critical for workforce identity to make MFA enforcement palatable to users.
SSO is the highest-leverage control in workforce identity and the one that concentrates risk: one credential now opens everything behind it, so the session lifetime, the strength of the factor, and the detection around the identity provider all matter more than they did before. Nearly every large breach of the past three years reached SSO credentials first and used them normally.
See also: federation, identity provider, SAML vs OIDC, IAM vendors
Related on Start with Identity
- GlossaryRelying Party (RP)
The application that relies on an external identity provider to authenticate users. The term is used in OIDC and WebAuthn. The RP validates tokens or assertions
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan