CVE-2021-21239

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.

• CWE-347

• https://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99Patch, Third Party Advisory
• https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0Third Party Advisory
• https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00038.htmlMailing List, Third Party Advisory
• https://pypi.org/project/pysaml2Product, Third Party Advisory
• https://www.aleksey.com/pipermail/xmlsec/2013/009717.htmlExploit, Mailing List, Third Party Advisory
• https://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99Patch, Third Party Advisory
• https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0Third Party Advisory
• https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00038.htmlMailing List, Third Party Advisory
• https://pypi.org/project/pysaml2Product, Third Party Advisory
• https://www.aleksey.com/pipermail/xmlsec/2013/009717.htmlExploit, Mailing List, Third Party Advisory

Published

Jan 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21233Heap buffer overflow in ANGLE in Google Chrome on Windows pr…8.8
• CVE-2021-21234spring-boot-actuator-logview in a library that adds a simple…7.7
• CVE-2021-21235kamadak-exif is an exif parsing library written in pure Rust…6.5
• CVE-2021-21236CairoSVG is a Python (pypi) package. CairoSVG is an SVG conv…5.5
• CVE-2021-21237Git LFS is a command line extension for managing large files…7.8
• CVE-2021-21238PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-2124Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2021-21240httplib2 is a comprehensive HTTP client library for Python. …7.5
• CVE-2021-21241The Python "Flask-Security-Too" package is used for adding s…7.4
• CVE-2021-21242OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21243OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21244OneDev is an all-in-one devops platform. In OneDev before ve…9.8