CVE-2026-9487

Name of the Vulnerable Software and Affected Versions XML::Sig versions prior to 0.71

Description XML::Sig allows signature wrapping through the use of duplicate IDs. The get signed xml() function in lib/XML/Sig.pm, which is called from verify(), resolves the SignedInfo Reference/@URI to a node using the XPath expression //*[@ID='$id'] and returns only the first node found. If a document contains two elements with the same ID, the system validates the digest and signature against the first element in document order without detecting the duplicate. This allows a document to verify successfully while an application resolving the ID independently may process a second, attacker-controlled element. In a SAML2 context, this can allow an attacker to control the contents of an Assertion.

Recommendations Update to version 0.71 or later.