A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to on and security However, an attacker was able to spoof a registered account on the network and query the SAML

When an attacker can spoof a registered account and query a SAML provider, the most common exploitation is forging or manipulating SAML assertions to authenticate as a different (often privileged) user. This is known as SAML assertion forgery or XML signature wrapping, where the attacker crafts or modifies a SAML response to claim a different identity, bypassing proper authentication controls.

SAML assertions are used for authentication and authorization of existing identities, not for registering new accounts; account provisioning is a separate process not directly exposed through SAML assertion queries.

Using a spoofed SAML assertion to conduct a DoS attack is not a common or practical exploitation of this flaw, as the primary value of SAML spoofing is unauthorized access, not service disruption.

Exchanging authentication and authorization data between security domains describes the legitimate, intended function of SAML federation, not an attack leveraging a spoofed account or forged assertion.