SAML Authentication Bypass in Net::SAML2 for Perl
CVE-2026-18092
Currently unrated
What is CVE-2026-18092?
The vulnerability in Net::SAML2 allows an attacker to bypass SAML authentication through XML signature wrapping. This occurs because the 'new_from_xml' function processes identity information using document-wide XPath expressions, which can select elements outside of the signed context. By exploiting this flaw, an attacker with a valid IdP-signed assertion can insert an unsigned, attacker-controlled assertion into the document, leading to unauthorized authentication as an arbitrary user. This risk exists even when proper CA certificate configurations are in place, making it crucial for users to upgrade to version 0.86 or later to mitigate this threat.
Affected Version(s)
Net::SAML2 0 < 0.86