CVE-2026-86304

Received Received - Intake

SAML Authentication Bypass in MojoX::Authentication

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: CPANSec

Description

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-06

Generated

2026-09-07

AI Q&A

2026-09-07

EPSS Evaluated

N/A

NVD

CVE-2026-86304

EUVD

EUVD-2026-72177

Affected Vendors & Products

Vendor	Product	Version / Range
mojox	authentication	to 0.006 (exc)
net	saml2	to 0.86 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability is a SAML authentication bypass in MojoX::Authentication versions before 0.006 for Perl. It occurs because parse_assertion does not properly validate SAML responses, allowing attackers to bypass authentication by posting a response signed with their own certificate.

Detection Guidance

To detect this vulnerability, check if your system uses MojoX::Authentication versions before 0.006 or Net::SAML2 versions before 0.86. Inspect Perl module versions with commands like 'cpan -D MojoX::Authentication' or 'cpan -D Net::SAML2'. Review SAML authentication logs for unsigned or self-signed assertions.

Impact Analysis

An attacker could impersonate any user by crafting a SAML response with a valid signature but controlled by the attacker. This could grant unauthorized access to systems relying on SAML authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to inadequate authentication controls.

Mitigation Strategies

Update MojoX::Authentication to version 0.006 or later and Net::SAML2 to version 0.86 or later to address the SAML authentication bypass issue.

Hi! I’m here to help you understand CVE-2026-86304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70