CVE-2026-18089

Name of the Vulnerable Software and Affected Versions Net::SAML2 versions prior to 0.86

Description An authentication bypass exists when no trust anchor is configured. The verify xml function in Net::SAML2::Role::VerifyXML allows responses to be verified against the certificate embedded within the response itself. This occurs because the system uses the X.509 certificate from the dsig:KeyInfo/dsig:X509Certificate element of the response. Consequently, if Binding::POST is constructed without a cacert or if Assertion->new from xml is called without cacert, cert text, or anchors arguments, the system may accept a response signed by an attacker-generated key, allowing the authentication of arbitrary assertions.

Recommendations Update to version 0.86 or later. As a temporary mitigation, ensure that cacert, cert text, or anchors arguments are explicitly provided when constructing Binding::POST or calling Assertion->new from xml to avoid relying on response-embedded certificates.