XML::Sig CVE-2026-18568

Exploitation requires the target application to pass attacker-controlled XML to XML::Sig's verify() function on a version between 0.29 and 0.71 inclusive. Two distinct triggering paths exist: (1) the crafted XML contains two or more dsig:Signature elements where at least one SignedInfo/Reference/@URI resolves to no element in the document - this triggers the numsigs-greater-than-1 skip regardless of id_attr setting; (2) the application sets the id_attr option and the Reference does not match the requested ID. Providing a cert or cert_text trust anchor does not prevent exploitation because no key check is reached. Exploitation is bounded by: the application must actually invoke verify() on untrusted input; the version range is strictly 0.29-0.71 (the vulnerable XPath-based path was introduced in 0.29); and versions 0.28 and earlier are immune due to a different verify implementation.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately represents the attack profile: no authentication required, no user interaction, low complexity, and full integrity bypass. This is not a case of inflated CVSS - the bypass is straightforward to trigger, requiring only two Signature elements with Reference URIs pointing to nonexistent element IDs, as demonstrated by the test case in the fix commit. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. This CVE is not currently listed in the CISA KEV catalog, and no public standalone exploit has been identified beyond the commit-embedded test. The practical impact is severe for any application using XML::Sig for authentication, authorization, or data integrity decisions: an attacker can forge arbitrary signed XML that is accepted as valid. Applications that supply a cert or cert_text trust anchor are equally affected because no key check reaches execution under the vulnerable control flow, making the trust anchor a false sense of security.

An attacker submits a crafted XML document to a SAML assertion processor or other XML signature-verifying application built on XML::Sig 0.29-0.71. The document contains two dsig:Signature elements whose SignedInfo/Reference/@URI values reference an element ID that does not exist anywhere in the document. The verify() function iterates over both signatures, silently skips each before performing any digest or key check via the numsigs-greater-than-1 path, and returns true. The attacker's document - with arbitrary tampered content - is accepted as cryptographically valid, potentially granting elevated privileges or bypassing access controls.