Not exactly an incompatibility, but my mind jumped to issues like this: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SAML%20Injection/README.

Not exactly an incompatibility, but my mind jumped to issues like this: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SAML%20Injection/README.md#xml-comment-handling https://github.com/swisskyrepo/PayloadsAllTheThings/blob/mas... <NameID>user@user.com<!--XMLCOMMENT-->.evil.com</NameID> Some parsers will take just the first text element ("user@user.com"), and others will concatenate the text elements ("user@user.com.evil.com").