CVE-2016-10127

9.0 criticalEPSS 2.6%

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

Severity

9.0 critical

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2017-03-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m269-wj6g-c459	PyPI	pysaml2	<4.5.0	4.5.0
PYSEC-2017-67	PyPI	pysaml2	<4.5.0	4.5.0