EUVD-2026-52266
GHSA-p5j9-p2w8-q5rw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SAML ACS endpoints are public-facing and unauthenticated by design; no confidentiality or availability impact - only integrity via identity forgery.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.
verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with "return $xml unless $cacert;".
Any caller that constructs Binding::POST or calls Assertion->new_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.
AnalysisAI
SAML authentication bypass in Net::SAML2 versions before 0.86 for Perl allows remote unauthenticated attackers to forge arbitrary SAML assertions against service providers that omit a trust anchor during library configuration. The flaw is in verify_xml, which exits early after validating the XML signature against the certificate embedded within the response itself - meaning an attacker who controls the response can supply their own self-signed certificate and sign any assertion they choose. No public exploit is identified at time of analysis, but the vulnerability is mechanically trivial to reproduce given that the vulnerable code path is fully documented in referenced MetaCPAN source files.
Technical ContextAI
Net::SAML2 is a Perl CPAN module (author TIMLEGGE, CPE cpe:2.3:a:timlegge:net::saml2:*:*:*:*:*:*:*:*) implementing SAML 2.0 for service provider roles. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the function verify_xml in Net::SAML2::Role::VerifyXML (visible at MetaCPAN 0.85 source, line 32) calls XML::Sig to check the response signature, then immediately returns success with 'return if !$anchors && !$cacert' when no trust anchors are present. The XML::Sig check itself validates the signature against the X.509 certificate extracted from the response's own dsig:KeyInfo/dsig:X509Certificate element - a certificate entirely attacker-controlled. Binding::POST (POST.pm line 21) declares cacert as an optional Maybe[Str] with no default value, so any caller that omits cacert silently takes the unanchored path. The same early-return logic appears in _verify_encrypted_assertion (Assertion.pm line 84), which returns the raw XML unless cacert is set.
RemediationAI
Upgrade Net::SAML2 to version 0.86 or later immediately; the changelog confirming the fix is at https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.88/source/Changes - upgrading to the latest available release (0.88 at time of writing) is safest, as fixes may have been applied incrementally across 0.86-0.88. If an immediate upgrade is not possible, the only effective compensating control is to audit every caller of Binding::POST->new and Assertion->new_from_xml in your Perl codebase and ensure each invocation explicitly passes a cacert, cert_text, or anchors parameter pointing to the trusted identity provider's certificate or CA bundle. Omitting this parameter is the direct cause of the vulnerability; there is no network-layer mitigation (WAF or firewall rule) that can substitute, since the attack arrives as a structurally valid SAML POST. Note that adding trust anchor parameters requires knowledge of which IdP certificates are legitimate - coordinate with your IdP operator to obtain the correct signing certificate before applying this workaround.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today