CVE-2026-86304

Name of the Vulnerable Software and Affected Versions MojoX::Authentication versions prior to 0.006

Description An authentication bypass exists in the SAML implementation. The parse assertion function in MojoX::Authentication::Model::SAML2 initializes Net::SAML2::Binding::POST without a trust anchor. When this is combined with Net::SAML2 versions before 0.86, the signature on an unencrypted assertion is validated against the certificate provided within the response itself rather than a trusted authority. This allows an attacker to authenticate as any user by providing a SAML response signed with a certificate they control, provided they satisfy the audience, InResponseTo, and timestamp requirements.

Recommendations Update MojoX::Authentication to version 0.006 or later.