EUVD-2026-72177
GHSA-34pg-3x4x-4vf5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated full impersonation gives high confidentiality and integrity impact; availability is not directly affected, so A:N rather than the input's A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.
parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries.
An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.
AnalysisAI
SAML authentication bypass in the Perl module MojoX::Authentication before 0.006 lets a remote unauthenticated attacker impersonate any user by forging a SAML response. The module's parse_assertion routine constructs a Net::SAML2::Binding::POST object without any trust anchor (no cacert, cert_text, or anchors), so the signature on an unencrypted assertion is validated against the certificate embedded in the response itself rather than the trusted IdP signing certificate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target web application uses MojoX::Authentication (before 0.006) as a SAML 2.0 service provider and accepts UNENCRYPTED assertions - the flaw is in the unencrypted-assertion signature path, so IdP-encrypted assertions are not bypassable this way. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is largely justified for confidentiality and integrity: a remote, unauthenticated attacker who can reach the SP login endpoint can forge assertions and log in as any NameID, including administrative accounts, which is a full authentication bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MojoX::Authentication to version 0.006 or later, which supplies a proper trust anchor when constructing the POST binding (Vendor-released patch: 0.006). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of all applications and services using MojoX::Authentication to identify affected systems and their business criticality; document findings and notify development teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today