As a result of research & coordinated disclosure by our Francesco Lacerenza, a new patch was released for the crewjam SAML #golang library. Affected versions (< 0.4.14) are vulnerable to cross-site scripting (XSS) on the IdP.