CVE-2026-18092
Received Received - Intake

SAML Authentication Bypass in Net::SAML2

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: CPANSec

Description
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document order rather than the element covered by the verified signature. handle_response confirms that a signature is present and, when a cacert is configured, that it chains to the CA, but XML::Sig verifies only the element named by the signature's Reference URI, so unsigned sibling assertions in the same document are not covered. An attacker who holds any one IdP-signed assertion can add an unsigned attacker-authored assertion earlier in document order; the signature still verifies and the document-order XPath returns the attacker's NameID and attributes. Any caller that passes an untrusted Response to new_from_xml can accept identity fields from an assertion the IdP never signed, even when a cacert trust anchor is configured, so a party holding one valid IdP-signed assertion can authenticate as an arbitrary user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18092
EUVD
EUVD-2026-52291

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
net saml2 to 0.86 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML signature wrapping attack in Net::SAML2 versions before 0.86 for Perl. It allows SAML authentication bypass by exploiting how the library reads identity fields like NameID and attributes using document-wide XPath instead of the signed subtree. An attacker can add an unsigned assertion earlier in the document, which the library then uses for authentication, even though the IdP only signed a different assertion.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Net::SAML2 versions before 0.86. Inspect installed Perl modules with commands like 'cpan -D Net::SAML2' or 'perl -MNet::SAML2 -e "print $Net::SAML2::VERSION"'. If the version is below 0.86, the system is vulnerable.

Impact Analysis

If you use Net::SAML2 versions before 0.86, an attacker who holds a valid IdP-signed assertion could impersonate any user by injecting an unsigned assertion. This means unauthorized access to systems relying on SAML authentication, potential data breaches, or privilege escalation, even if signature verification is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result from failed authentication controls, unauthorized data exposure, or inability to ensure proper access logging and user accountability.

Mitigation Strategies

Immediately upgrade Net::SAML2 to version 0.86 or later. Review SAML responses for unsigned assertions and ensure XML::Sig verifies the correct signed subtree. Disable document-wide XPath queries in favor of signature-covered elements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart