XML::Sig CVE-2026-9487

Exploitation requires that the target application uses XML::Sig (before 0.71) to verify a signature whose SignedInfo Reference points to an element by ID, and that some component downstream re-resolves that same ID independently to consume element content - the canonical case being a SAML2 Service Provider that verifies with XML::Sig and then reads the Assertion (the description's 'in a SAML2 context this places the contents of an Assertion under attacker control'). The attacker must be able to supply a crafted document containing two elements sharing the referenced ID value and must possess at least one validly signed element to wrap around (e.g., a captured or replayed signed assertion). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed to submit the document, but exploitation is limited to workflows that verify XML signatures via this library; installations already on 0.71+ are not exploitable, and applications that consume exactly the signed node (rather than re-querying by ID) are not affected in practice.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) indicates a network-reachable, low-complexity, unauthenticated attack - consistent with the description, since an attacker only needs to submit a crafted XML/SAML document to a service that verifies with XML::Sig. There is no EPSS score, no KEV listing, and no explicit POC flag in the provided data, so this is not confirmed as actively exploited; however, the fix commit includes a working test (t/030-reject-duplicate-id.t) that demonstrates the bypass, meaning the exploitation technique is effectively public even if a packaged exploit is not. This is a genuine high priority for anyone using XML::Sig for SAML SSO, because successful exploitation is an authentication/impersonation bypass rather than a mere information leak. Two caveats: the supplied Tags ('Denial Of Service', 'Jwt Attack') look mislabeled - the actual impact is signature-wrapping/authentication bypass, not DoS or JWT - and Scope is scored S:U although the real impact falls on the consuming application (a signature library), so an S:C interpretation is defensible.

An attacker obtains or intercepts a legitimately signed SAML assertion (ID="dup") and appends a second saml:Assertion with the same ID="dup" but attacker-chosen Subject content after the signed element. The Perl SAML SP calls XML::Sig->verify(), which matches the signature against the first (legit) assertion and returns success, while the application's assertion-consumption code reads the second element - logging the attacker in as an arbitrary user. The vendor's regression test t/030-reject-duplicate-id.t demonstrates exactly this wrapping technique end to end.