CVE-2026-18089 TIMLEGGE CVE debrief

Who should care

Users of Net::SAML2 versions before 0.86 for Perl should be aware of this vulnerability and take necessary actions to prevent SAML authentication bypass. This includes reviewing the presence of affected product deployments in their environments, assessing the potential risks associated with this vulnerability, and implementing compensating controls or mitigations as needed. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on authentication and authorization mechanisms.

Technical summary

The verify_xml function in Net::SAML2::Role::VerifyXML runs 'return if !$anchors && !$cacert;' as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsig:X509Certificate element. This allows an attacker to generate a response signed by an attacker-generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion. Affected product deployments should be reviewed for exposure and updated to version 0.86 or later to prevent SAML authentication bypass.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows for SAML authentication bypass.

Recommended defensive actions

• Update Net::SAML2 to version 0.86 or later
• Configure a trust anchor to prevent authentication bypass
• Verify and validate SAML responses using a secure method
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the NVD and Metacpan sources indicates that Net::SAML2 versions before 0.86 are vulnerable to SAML authentication bypass. The vulnerability is due to the verify_xml function verifying responses against the response-embedded certificate when no trust anchor is configured. Further review of the codebase and additional sources did not reveal specific details on the potential impact or exploitability of this vulnerability. However, defenders should verify the presence of affected product deployments in their environments and assess the potential risks associated with this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.