Information Disclosure

pysaml2 is vulnerable to information disclosure. After opening a file, the library does not close the filereader, allowing file descriptors to possibly leak...

Sanity Check Bypass

PySAML2 is vulnerable to sanity bypass. By failing a check and not causing an exception, malicious attackers can bypass all future checks. These checks can be failed by setting a wrong value for the destination or using a mismatched response ID...

XML External Entity (XXE)

PySAML2 is vulnerable to XML external entity attacks XXE. The library does not look for SAML XML requests or responses resulting in the ability to attack...