EUVD-2026-52270
GHSA-wqp7-2ww4-q6mf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network submission of a crafted document (PR:N/AV:N/AC:L) bypasses signature checks, enabling assertion forgery and impersonation (I:H) and access as the victim (C:H); no availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.
Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
AnalysisAI
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses XML::Sig (before 0.71) to verify a signature whose SignedInfo Reference points to an element by ID, and that some component downstream re-resolves that same ID independently to consume element content - the canonical case being a SAML2 Service Provider that verifies with XML::Sig and then reads the Assertion (the description's 'in a SAML2 context this places the contents of an Assertion under attacker control'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) indicates a network-reachable, low-complexity, unauthenticated attack - consistent with the description, since an attacker only needs to submit a crafted XML/SAML document to a service that verifies with XML::Sig. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains or intercepts a legitimately signed SAML assertion (ID="dup") and appends a second saml:Assertion with the same ID="dup" but attacker-chosen Subject content after the signed element. The Perl SAML SP calls XML::Sig->verify(), which matches the signature against the first (legit) assertion and returns success, while the application's assertion-consumption code reads the second element - logging the attacker in as an arbitrary user. … |
| Remediation | Upgrade to XML::Sig 0.71 or later - Vendor-released patch: version 0.71, which changes verify() to call findnodes('//*[@ID=...]') and reject any document where the reference ID matches more than one element (returns 0 when $ref_count > 1), plus zero-match handling; the fix is in commit 4976bde5245df69b8e02c6ae061acbd4891cd7f9 (https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch) and documented at https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Perl XML::Sig module versions prior to 0.71, prioritizing SAML2 service providers and authentication infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today