This post is a pretty good overview of why oauth2/openid are more popular.
Not to say that oauth/openid have never ever had vulnerabilities of their own, but there is a big difference between "accept these configurations" and what saml is, which is "parse this xml".