Net::SAML2 EUVD-2026-52266

Exploitation requires that the target Perl application constructs Binding::POST or calls Assertion->new_from_xml without supplying a cacert, cert_text, or anchors argument - meaning no trust anchor is configured for SAML signature validation. This is a deployment-level misconfiguration, not a default-secure baseline: applications that correctly pass a trust anchor are entirely unaffected regardless of Net::SAML2 version. The attacker must be able to reach the application's SAML assertion consumer service (ACS) endpoint over the network and submit an HTTP POST request; no prior authentication to the application is required, since ACS endpoints accept unauthenticated POSTs by SAML specification. Exploitation is limited to service providers built on Net::SAML2 versions before 0.86 in Perl; IdP-side configurations and non-Perl SAML implementations are out of scope.

The provided CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the threat model for vulnerable deployments: network-reachable SAML assertion consumer service endpoints are public-facing by design, exploitation requires no authentication, and attack complexity is low because no special conditions beyond reaching the endpoint are needed. No KEV listing and no confirmed POC exist at time of analysis, which lowers urgency slightly, but the vulnerability is mechanically trivial - the logic flaw is fully visible in public MetaCPAN source code and requires only standard SAML tooling to exploit. The critical limiting factor is deployment configuration: services that correctly pass a cacert, cert_text, or anchors argument are entirely unaffected. This means risk is high for misconfigured deployments but zero for correctly-configured ones, making a code audit of all Net::SAML2 callers the essential first step. EPSS data is not provided in the input; given the niche Perl library footprint, widespread automated scanning is unlikely but targeted exploitation of known misconfigured SSO deployments is plausible.

An attacker identifies a Perl web application using Net::SAML2 for SSO whose POST binding was instantiated without a cacert argument. The attacker generates a self-signed X.509 key pair, crafts a SAML Response asserting any identity (e.g., an administrative user), signs it with their private key, and embeds the corresponding self-signed certificate in the dsig:KeyInfo element of the response XML. Posting this to the application's assertion consumer service URL causes Net::SAML2 to validate the signature as correct (it is, against the embedded key), find no trust anchor to enforce, and accept the forged identity - granting the attacker authenticated access as the claimed user.