CVE-2021-21239

CVE-2021-21239 describes an improper cryptographic signature verification vulnerability in PySAML2 versions prior to 6.5.0, specifically impacting users who rely on the default CryptoBackendXmlSec1 backend to verify signed SAML documents. The vulnerability arises because the xmlsec1 binary, used by PySAML2, accepts any key type for signature verification by default, rather than explicitly requiring X.509 certificates. This allows an attacker to potentially bypass signature validation on SAML documents. Rated with a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R) to be exploited. A successful exploit could lead to high integrity impact (I:H) by allowing an attacker to forge SAML documents, though confidentiality and availability are not directly affected. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.