fix SAML2 vulnerability