CVE-2026-18092 TIMLEGGE CVE debrief

Who should care

Anyone using Net::SAML2 versions before 0.86 for Perl should be concerned about this vulnerability. This includes developers and administrators who use the library for SAML authentication in their applications, as well as operators and security teams who manage and monitor these applications. Additionally, vulnerability management teams should prioritize patching or mitigating this vulnerability to prevent potential attacks. Security teams should also review the configuration of the Net::SAML2 library to ensure that it is using a trusted certificate authority and monitor for any suspicious activity related to SAML authentication.

Technical summary

The Net::SAML2 library for Perl is vulnerable to SAML authentication bypass via XML signature wrapping due to the use of document-wide XPath in the new_from_xml function. This allows an attacker to add an unsigned assertion to the XML document, potentially leading to authentication as an arbitrary user. To address this, users should apply patches or updates to ensure the library is using a trusted certificate authority and monitor for suspicious activity related to SAML authentication.

Defensive priority

High-priority defensive actions are required to address the SAML authentication bypass vulnerability in Net::SAML2 versions before 0.86 for Perl.

Recommended defensive actions

• Apply the patch from https://github.com/perl-net-saml2/perl-Net-SAML2/commit/201fead7f42b83f40c84bf4a311a25b09acd18f9.patch
• Review and apply the release notes from https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.86/changes
• Verify the configuration of the Net::SAML2 library to ensure that it is using a trusted certificate authority
• Monitor for any suspicious activity related to SAML authentication
• Consider implementing additional security controls, such as multi-factor authentication

Evidence notes

Evidence from the NVD and CVE.org indicates that Net::SAML2 versions before 0.86 for Perl are vulnerable to SAML authentication bypass via XML signature wrapping. The vulnerability is due to the use of document-wide XPath in the new_from_xml function, which allows an attacker to add an unsigned assertion to the XML document. To verify, defenders should review the configuration of the Net::SAML2 library to ensure that it is using a trusted certificate authority and monitor for any suspicious activity related to SAML authentication.

Official resources