CVE-2026-18089

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18089
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18089.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18089
Published
2026-08-03T12:42:08Z
Modified
2026-08-12T04:17:26Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Details

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.

verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with "return $xml unless $cacert;".

Any caller that constructs Binding::POST or calls Assertion->new_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-295",
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18089.json"
}
References

Affected packages

Git / github.com/perl-net-saml2/perl-net-saml2

Affected ranges

Type
GIT
Repo
https://github.com/perl-net-saml2/perl-net-saml2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b679659178e278a4a53fe88d9eb58461a6e78b13
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.86"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.19.05
0.20
0.20.03-TRIAL
0.25
0.29
0.30-TRIAL
0.31-TRIAL
0.32
0.33-TRIAL
0.34
0.35-TRIAL
0.36-TRIAL
0.37-TRIAL
0.38
0.39
0.40
0.41
0.42
0.43
0.44
0.45
0.47
0.48
0.49
0.51
0.52
0.53
0.54
0.55
0.56
0.57
0.58
0.60
0.61
0.62
0.63
0.64
0.65
0.66
0.67
0.68
0.69
0.70
0.71
0.72
0.73
0.74
0.75
0.76
0.77
0.78
0.79
0.80
0.81
0.82
0.83
0.84
0.85
perl-net-saml2-0.*
perl-net-saml2-0.19.05
v0.*
v0.10
v0.11
v0.12
v0.14
v0.15
v0.16
v0.17
v0.17_06
v0.20
v0.26-TRIAL

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18089.json"