A licensed deployment with a configured SAML client can authenticate an identity from an assertion that fails the audience check. If the identity provider uses assertion-level signing, an attacker can combine a valid IdP-signed assertion for a victim (intended for any audience) with their own valid assertion for the target audience. This occurs because the `validateSamlResponseAudience` function accepts an audience from one assertion while the `extractAllClaims` function retrieves the final NameID and attributes from another. Additionally, an assertion issued to a different SuperTokens deployment using the shared default `saml sp entity id` can satisfy the audience check of the target deployment. Successful exploitation allows an attacker to authenticate as the victim IdP user.