CVE-2026-18108 TIMLEGGE CVE debrief

Who should care

Administrators and developers using Net::SAML2 for authentication in Perl applications should be aware of this critical vulnerability and take immediate action to patch or mitigate the risk.

Technical summary

The _verify_encrypted_assertion method in Net::SAML2 versions before 0.86 for Perl does not properly verify the signature of decrypted EncryptedAssertion objects. This allows an attacker to create an unsigned assertion, encrypt it to the service provider's encryption certificate, and authenticate as any user without proper validation. Affected product deployments should review configurations to ensure decryption keys are properly secured and monitor for suspicious activity related to SAML assertions. The vulnerability arises from the method's logic, which decrypts the EncryptedAssertion and returns it as verified when it carries no signature. This enables unauthenticated parties to authenticate as an arbitrary user. Administrators and developers using Net::SAML2 for authentication in Perl applications should be aware of this critical vulnerability and take immediate action to patch or mitigate the risk.

Defensive priority

High priority due to critical CVSS score of 9.8 and potential for widespread exploitation.

Recommended defensive actions

• Apply the official patch to upgrade to Net::SAML2 version 0.86 or later.
• Review and update configurations to ensure decryption keys are properly secured.
• Monitor for suspicious activity related to SAML assertions.
• Verify the integrity of SAML metadata and encryption certificates.
• Implement additional authentication measures for sensitive services.

Evidence notes

Evidence from the NVD and CVE.org indicates a critical vulnerability in Net::SAML2 versions before 0.86. The vulnerability allows for authentication bypass due to improper verification of encrypted assertions. Official references and patches are provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.