CVE-2026-18568

Name of the Vulnerable Software and Affected Versions XML::Sig versions 0.29 through 0.71

Description An issue exists where signature verification can be bypassed because the verify() function in lib/XML/Sig.pm returns true if all signatures are skipped before any cryptographic checks are performed. This occurs when the loop iterating over //dsig:Signature elements reaches a next statement via two specific paths: when a SignedInfo/Reference/@URI resolves to no element while $numsigs is greater than 1, or when id attr is set and a reference does not match the requested ID. Because the loop does not track which signatures were actually validated, the function reaches an unconditional return 1 if all signatures follow these paths. Consequently, a caller providing untrusted XML can receive a positive verification result for a document where no digest or signature value was checked, regardless of whether a cert or cert text trust anchor is used.

Recommendations Update XML::Sig to version 0.72 or later.