Reminds me a bit of the CVE about SAML authentication being screwed up by bad XML parsers. Seems like a lot of low hanging fruit there still.

[0] https://duo.com/blog/duo-finds-saml-vulnerabilities-affectin...