CVE-2026-18092

Name of the Vulnerable Software and Affected Versions Net::SAML2 versions prior to 0.86

Description An authentication bypass exists due to XML signature wrapping. The new from xml() function retrieves identity fields—including NameID, attribute values, SessionIndex, and audience—using document-wide XPath queries (such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID). These queries select the first matching element in document order rather than the specific element covered by the verified signature. While handle response() confirms the presence of a signature and its chain to a CA, the underlying verification only covers the element named by the signature's Reference URI. Consequently, an attacker possessing a single valid IdP-signed assertion can insert an unsigned, malicious assertion earlier in the document order. This allows the attacker to authenticate as an arbitrary user by manipulating the identity fields returned by the XPath search.

Recommendations Update to version 0.86 or later.