CVE-2021-27736: Fusionauth SAML v2

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.

Affected products

• Fusionauth SAML v2: before 0.5.4 (fixed in 0.5.4)

Published 2021-04-22. Last modified 2026-06-17.