CVE-2026-18089 Overview
CVE-2026-18089 is a SAML authentication bypass vulnerability in the Net::SAML2 Perl module in versions before 0.86. The flaw exists in the verify_xml routine within Net::SAML2::Role::VerifyXML, which validates SAML responses against the X.509 certificate embedded in the response itself when no trust anchor is configured. An attacker can sign a SAML response with a self-signed key and embed the matching certificate in the response's dsig:KeyInfo/dsig:X509Certificate element. The library accepts this signature as valid, authenticating arbitrary assertions and bypassing identity provider trust.
Critical Impact
Attackers can forge SAML responses to authenticate as any user against applications using Net::SAML2 without a configured cacert or trust anchor.
Affected Products
- Net::SAML2 for Perl versions prior to 0.86
- Applications constructing Net::SAML2::Binding::POST without a cacert argument
- Applications calling Net::SAML2::Protocol::Assertion->new_from_xml without cacert, cert_text, or anchors
Discovery Timeline
- 2026-08-03 - CVE-2026-18089 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18089
Vulnerability Analysis
The vulnerability is an improper certificate validation flaw [CWE-295] in the SAML response verification path. Net::SAML2 uses the verify_xml function to check the digital signature on incoming SAML assertions. When neither $anchors nor $cacert is supplied, verify_xml executes return if !$anchors && !$cacert; immediately after the XML::Sig check succeeds. That signature check consumes the X.509 certificate carried inside the response's own dsig:KeyInfo/dsig:X509Certificate element.
The response is therefore validated only against the key it transports, not against a trusted identity provider certificate. An attacker who generates a fresh RSA key pair and a self-signed certificate can produce a syntactically valid, cryptographically consistent SAML response that the library accepts. This authenticates arbitrary assertions, including forged NameID and attribute values, breaking the trust boundary that SAML federation depends on.
Root Cause
Net::SAML2::Binding::POST declares cacert as an optional Maybe[Str] with no default value. Callers that instantiate Binding::POST without providing one silently take the unanchored code path. The _verify_encrypted_assertion helper compounds the issue by returning early with return $xml unless $cacert;, skipping signature verification entirely for encrypted assertions when no trust anchor is set. The library does not fail closed when trust material is absent.
Attack Vector
An unauthenticated remote attacker crafts a SAML response, signs it with an attacker-controlled key, and embeds the matching self-signed certificate in dsig:KeyInfo. The attacker submits this response to any relying party built on a vulnerable Net::SAML2 deployment. The verify_xml routine validates the signature against the embedded certificate, returns success, and the application accepts the forged assertion. Exploitation requires no privileges, no user interaction, and no local access.
See the MetaCPAN VerifyXML source, Binding::POST source, and Assertion source for the exact code paths involved.
Detection Methods for CVE-2026-18089
Indicators of Compromise
- SAML responses containing dsig:X509Certificate elements whose issuer and subject match a self-signed certificate not chained to a known identity provider.
- Successful authentication events for users whose assertions arrive from unusual Issuer values or unrecognized signing certificate fingerprints.
- Application logs showing SAML NameID values inconsistent with recent identity provider audit records.
Detection Strategies
- Inventory Perl applications and dependency manifests for Net::SAML2 versions below 0.86 using package listings such as cpanm --showdeps output or cpanfile.snapshot records.
- Statically scan source code for Net::SAML2::Binding::POST->new and Assertion->new_from_xml calls that omit cacert, cert_text, or anchors arguments.
- Compare signing certificate fingerprints observed in SAML traffic against a known-good identity provider certificate allowlist.
Monitoring Recommendations
- Log the certificate fingerprint used to verify every inbound SAML response and alert on values outside the approved set.
- Monitor authentication logs for successful SAML logins that lack a corresponding session at the identity provider.
- Track deployments of Net::SAML2 in the software bill of materials and flag versions below 0.86 for remediation.
How to Mitigate CVE-2026-18089
Immediate Actions Required
- Upgrade Net::SAML2 to version 0.86 or later on all Perl services processing SAML responses.
- Audit every Binding::POST and Assertion->new_from_xml construction site and add an explicit cacert or anchors argument pinned to the identity provider certificate.
- Rotate any session tokens or credentials issued during the exposure window if unauthenticated SAML traffic reached the application.
Patch Information
The maintainer released fixed versions in the Net::SAML20.86 line and later. Review the Net::SAML2 0.88 Changes file for the full remediation history and upgrade to the latest published release.
Workarounds
- Configure a cacert or anchors argument on every Binding::POST instance so verify_xml validates against the trusted identity provider certificate rather than the embedded key.
- Reject SAML responses at a reverse proxy or web application firewall when the embedded X509Certificate fingerprint does not match the approved identity provider fingerprint.
- Disable SAML authentication paths that cannot be reconfigured with a trust anchor until the module is upgraded.
# Upgrade Net::SAML2 to a fixed release
cpanm Net::SAML2@0.88
# Verify installed version
perl -MNet::SAML2 -e 'print "$Net::SAML2::VERSION\n"'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
