EUVD-2026-52291
GHSA-657v-xpf8-79x2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Authentication bypass gives full access to victim account data (C:H); no crash or DoS path is described (A:N); attacker needs any IdP assertion but no SP credentials (PR:N, AC:L).
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree.
new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document order rather than the element covered by the verified signature. handle_response confirms that a signature is present and, when a cacert is configured, that it chains to the CA, but XML::Sig verifies only the element named by the signature's Reference URI, so unsigned sibling assertions in the same document are not covered. An attacker who holds any one IdP-signed assertion can add an unsigned attacker-authored assertion earlier in document order; the signature still verifies and the document-order XPath returns the attacker's NameID and attributes.
Any caller that passes an untrusted Response to new_from_xml can accept identity fields from an assertion the IdP never signed, even when a cacert trust anchor is configured, so a party holding one valid IdP-signed assertion can authenticate as an arbitrary user.
AnalysisAI
XML Signature Wrapping in Net::SAML2 before 0.86 allows any party holding a single valid IdP-signed assertion to authenticate as an arbitrary user against Perl applications that use this SAML SP library. Identity fields - NameID, attributes, SessionIndex, audience - are extracted via document-wide XPath queries selecting the first matching element in document order, not the element covered by the verified signature; an attacker who prepends an unsigned forged assertion to a Response containing their own legitimate signed assertion bypasses identity verification entirely while the signature check still passes. A vendor-released patch exists in version 0.86, and no public exploit has been identified at time of analysis.
Technical ContextAI
Net::SAML2 (CPE: cpe:2.3:a:timlegge:net::saml2:*:*:*:*:*:*:*:*) is a Perl CPAN library implementing SAML 2.0 Service Provider functionality. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): XML Digital Signatures in SAML protect only the element referenced by the signature's Reference URI, not the entire enclosing Response document. The vulnerable new_from_xml method used absolute document-wide XPath expressions such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which return the first element in document order across the whole document. handle_response confirmed the presence of a signature and, when cacert was set, that it chained to the CA, but XML::Sig only verifies the element identified by the Reference URI - unsigned sibling assertions in the same document are never covered. This is a classic XSW attack: inject an unsigned forged assertion before the signed one and document-order XPath resolves to the forged identity. The fix in commit 201fead7f42b83f40c84bf4a311a25b09acd18f9 introduces a context node derived from the cryptographically verified element and scopes all identity-field XPath queries to that trusted subtree, and adds _trusted_signature_refs to resolve and validate each signature's Reference URI against the CA before any extraction occurs.
RemediationAI
Upgrade Net::SAML2 to version 0.86 or later via CPAN (cpanm Net::SAML2 or cpan -i Net::SAML2). The fixing commit is documented at https://github.com/perl-net-saml2/perl-Net-SAML2/commit/201fead7f42b83f40c84bf4a311a25b09acd18f9.patch and the release changelog is at https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.86/changes. No viable configuration-level workaround preserves SAML functionality, because the flaw is inside the library's XML extraction logic and is not controlled by any caller-configurable option including cacert. If immediate patching is not possible, temporarily disabling the SAML authentication code path and falling back to an alternative authentication mechanism eliminates the attack surface at the cost of SSO availability until the patch can be deployed.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today