XML-DSig verifies whatever a Reference URI points to, typically an element with a given ID; the application then often locates "the assertion" by a different rule, for example the first Assertion child. Attackers wrap the genuine signed assertion inside an extension or another position and add an unsigned assertion where the application looks. Somorovsky and colleagues showed in 2012 that most SAML frameworks they tested were vulnerable, and variants keep appearing.
Defenses: process only the exact nodes that were verified (have the verifier return them), reject documents with duplicate IDs or unexpected structure through strict schema validation, require the signature to cover the whole response or assertion and use maintained SAML libraries. JSON-based formats avoid this particular class because the signature covers fixed bytes, though they have their own pitfalls.