CVE-2026-18092: Net::SAML2 Auth Bypass Vulnerability

CVE-2026-18092 Overview

CVE-2026-18092 is a SAML authentication bypass in the Net::SAML2 Perl module affecting versions before 0.86. The vulnerability enables XML Signature Wrapping (XSW) attacks against callers that pass untrusted SAML Responses to new_from_xml. An attacker holding any single Identity Provider (IdP)-signed assertion can inject an unsigned attacker-authored assertion earlier in document order. Because the module reads identity fields using document-wide XPath queries rather than the signed subtree, the injected assertion is accepted as authentic. The flaw is tracked under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
A party holding one valid IdP-signed assertion can authenticate as an arbitrary user, even when a cacert trust anchor is configured.

Affected Products

Net::SAML2 Perl module versions prior to 0.86
Perl applications relying on Net::SAML2 for SAML-based Single Sign-On (SSO)
Downstream service providers integrating this module for IdP-federated authentication

Discovery Timeline

2026-08-03 - CVE-2026-18092 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18092

Vulnerability Analysis

The vulnerability is a classic XML Signature Wrapping attack enabled by mismatched signature verification and data consumption scopes. The handle_response function confirms that a signature exists and, when a cacert is configured, that the signing certificate chains to the trusted Certificate Authority (CA). However, XML::Sig only validates the specific element referenced by the signature's Reference URI. Sibling assertions in the same XML document remain outside the verified scope.

The new_from_xml routine then extracts the NameID, attribute values, SessionIndex, audience, and other identity fields using document-wide XPath expressions such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID. These expressions return the first matching element in document order, not the element covered by the verified signature. An attacker who prepends an unsigned assertion authored with arbitrary identity claims causes the module to consume attacker-controlled data while still reporting the signature as valid.

Root Cause

The root cause is a scope mismatch between the cryptographic verification boundary and the data consumption boundary. XML::Sig verifies only the element identified by the signature reference, while new_from_xml queries identity fields from anywhere in the document. This violates the principle that only signed content should influence security decisions.

Attack Vector

An attacker must first obtain any valid IdP-signed SAML assertion, for example by initiating a legitimate authentication as themselves. The attacker then crafts a modified Response XML document containing a forged unsigned assertion with the target user's NameID and attributes, placed earlier in document order than the genuine signed assertion. When the victim service provider processes this document, the signature check succeeds against the legitimate assertion while the identity extraction returns the attacker's forged values.

No verified public exploit code is available at this time. Refer to the GitHub Commit Patch for the exact code paths affected and the corrective XPath scoping applied in version 0.86.

Detection Methods for CVE-2026-18092

Indicators of Compromise

SAML Response documents containing more than one <saml:Assertion> element at the top level of the same message.
Authentication events where the NameID in application logs does not match the subject inside the signature-referenced assertion element.
Successful SSO logins immediately following anomalous or repeated SAML Response submissions from the same client.

Detection Strategies

Parse inbound SAML Responses and alert when the count of saml:Assertion elements exceeds one, or when unsigned assertions appear alongside signed ones.
Compare the NameID extracted by the application against the NameID inside the element referenced by the XML signature's Reference URI.
Inventory Perl services using Net::SAML2 via CPAN manifests and flag any version below 0.86.

Monitoring Recommendations

Log full SAML Response payloads at the service provider for post-hoc forensic review of assertion structure.
Monitor for authentication anomalies such as a single source IP authenticating as multiple distinct principals within a short window.
Enable alerting on privileged account SSO logins so that any successful bypass targeting administrative users is investigated quickly.

How to Mitigate CVE-2026-18092

Immediate Actions Required

Upgrade Net::SAML2 to version 0.86 or later on all Perl-based service providers.
Audit deployed CPAN dependencies to identify any transitive use of vulnerable Net::SAML2 versions.
Rotate session tokens and force re-authentication for users of affected SSO-integrated applications after patching.
Review authentication logs for the presence of multi-assertion SAML Responses prior to the patch date.

Patch Information

The fix is available in Net::SAML2 version 0.86, published on MetaCPAN. See the MetaCPAN Release Changes and the upstream GitHub Commit Patch which corrects the XPath scoping so that identity fields are read exclusively from the signature-covered subtree.

Workarounds

If immediate upgrade is not possible, enforce IdP-side signing of the entire SAML Response, not just individual assertions, and reject any Response containing multiple assertions at the application layer.
Restrict acceptable IdPs to a single trusted issuer and validate the Issuer element against the signed assertion subtree before consuming identity fields.
Deploy a reverse proxy or Web Application Firewall (WAF) rule that rejects SAML Responses containing more than one saml:Assertion element.

bash

# Upgrade Net::SAML2 to the patched release
cpanm Net::SAML2@0.86

# Verify the installed version
perl -MNet::SAML2 -e 'print $Net::SAML2::VERSION, "\n"'