CVE-2026-9487 TIMLEGGE CVE debrief

Who should care

Developers and administrators using XML::Sig for SAML2 authentication, particularly those in environments relying on Perl-based SAML2 implementations, should verify their XML::Sig version and upgrade to 0.71 or later. They should also review and update affected applications to handle ID resolution independently and monitor for suspicious SAML2 assertions.

Technical summary

The XML::Sig library for Perl, versions before 0.71, is vulnerable to signature wrapping attacks due to its handling of duplicate IDs in XML documents. Specifically, the _get_signed_xml() function in lib/XML/Sig.pm uses the XPath expression '//*[@ID='$id']' to resolve SignedInfo Reference/@URI, returning the first node of the resulting node set. This allows an attacker to supply a second element with the same ID, which can be read by applications resolving the ID independently, potentially allowing for the manipulation of SAML2 assertions.

Defensive priority

Critical vulnerability in XML::Sig affecting SAML2 contexts; verify and apply patches immediately.

Recommended defensive actions

• Verify XML::Sig version and upgrade to 0.71 or later
• Review and update affected applications to handle ID resolution independently
• Monitor for and block suspicious SAML2 assertions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-9487 record indicates XML::Sig versions before 0.71 for Perl are vulnerable to signature wrapping via duplicate ID. The _get_signed_xml() function in lib/XML/Sig.pm resolves SignedInfo Reference/@URI to a node with the XPath expression '//*[@ID='$id']' and returns the first node of the resulting node set. This allows a document with two elements sharing the same ID value to be accepted, verifying successfully while an application resolving the same ID independently can read the second, attacker-supplied element.

Official resources