SAML Authentication Bypass in MojoX::Authentication for Perl by Polettix

CVE-2026-86304

What is CVE-2026-86304?

The MojoX::Authentication module for Perl, specifically versions before 0.006, is vulnerable to a SAML authentication bypass. This issue arises because the parse_assertion method fails to build the Net::SAML2::Binding::POST with the necessary trust anchor parameters. Consequently, an attacker can initiate a SAML login and post a response using their own signed certificate. Since the audience, InResponseTo, and timestamp checks can be manipulated, this allows the attacker to successfully authenticate any NameID they provide, potentially granting unauthorized access to sensitive resources.

References