PySAML2 XML external entity attack

CRITICAL 9.0CVE-2016-10127 · GHSA-m269-wj6g-c459 · PYSEC-2017-67 · Published 03/03/2017 · updated 17/06/2026

In short

CVE-2016-10127 is a CRITICAL (CVSS 9.0) vulnerability affecting pysaml2.
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.5% of all vulnerabilities.
Fix: update to 4.5.0 or later.

Package	Affected versions	Patched versions
pysaml2 PyPI	`< 4.5.0`	`4.5.0`

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

NVD description

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 4.5.0

4.5.0

More vulnerabilities in pysaml2

See all →