Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/pysaml2@4.7.0
purl pkg:pypi/pysaml2@4.7.0
Next non-vulnerable version 6.5.0
Latest non-vulnerable version 6.5.0
Risk
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-18jn-t4rf-13f1
Aliases:
CVE-2021-21238
GHSA-f4g9-h89h-jgv9
PYSEC-2021-48
signature forgery
6.5.0
Affected by 0 other vulnerabilities.
VCID-azuf-r76r-gkaa
Aliases:
CVE-2021-21239
GHSA-5p3x-r448-pc62
PYSEC-2021-49
signature forgery
6.5.0
Affected by 0 other vulnerabilities.
VCID-rydh-2y4u-u3ef
Aliases:
CVE-2020-5390
GHSA-qf7v-8hj3-4xw7
PYSEC-2020-94
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
5.0.0
Affected by 2 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:08:19.758172+00:00 Pypa Importer Affected by VCID-azuf-r76r-gkaa https://github.com/pypa/advisory-database/blob/main/vulns/pysaml2/PYSEC-2021-49.yaml 38.6.0
2026-06-02T04:08:19.544665+00:00 Pypa Importer Affected by VCID-18jn-t4rf-13f1 https://github.com/pypa/advisory-database/blob/main/vulns/pysaml2/PYSEC-2021-48.yaml 38.6.0
2026-06-02T04:06:05.171342+00:00 Pypa Importer Affected by VCID-rydh-2y4u-u3ef https://github.com/pypa/advisory-database/blob/main/vulns/pysaml2/PYSEC-2020-94.yaml 38.6.0