SAML
SAML 2.0 dates from 2005 and has not changed since: what evolves are the profiles, the uses and the attacks. Here are the landmarks.
Work begins on exchanging security information between domains in XML.
First OASIS standard: authentication, attribute and authorization assertions.
Corrections. Liberty Alliance contributes its ID-FF work to OASIS.
The version still in use: merges SAML 1.1, Liberty ID-FF and Shibboleth. Adds metadata, single logout (SLO), assertion encryption, the Redirect, POST and Artifact bindings.
Clarifications and corrections to the standard (errata still followed, until 2012).
Worldwide research and education federation, built on signed SAML metadata.
Researchers show that signature verification can be bypassed by moving XML elements. Many libraries were affected.
With an IdP's signing key, any assertion can be forged: access everywhere. Seen again in the SolarWinds attack in late 2020.
A parsing flaw allowed impersonating another user in several SAML libraries.
XML parsing differences allowed the signature to be bypassed. A reminder that the subject is never closed.
Sources: SAML history (saml.xml.org) for 2001 to 2007; the following entries come from known security publications. If you see a mistake, let us know. Compare with the OpenID Connect timeline.