CVE-2026-86304: MojoX::Authentication SAML Bypass Vulnerability

CVE-2026-86304 Overview

CVE-2026-86304 is a SAML authentication bypass in the Perl module MojoX::Authentication before version 0.006. The flaw resides in parse_assertion inside MojoX::Authentication::Model::SAML2, which instantiates Net::SAML2::Binding::POST without a trust anchor. Because no cacert, cert_text, or anchors argument is supplied, the SAML response signature is validated against whatever certificate the response itself carries. An attacker can post a SAML response signed with their own certificate and authenticate as any NameID. The weakness is classified as improper verification of a cryptographic signature [CWE-347].

Critical Impact

Unauthenticated remote attackers can impersonate arbitrary users by submitting a self-signed SAML response, fully bypassing federated login.

Affected Products

• MojoX::Authentication for Perl, versions before 0.006
• Deployments relying on MojoX::Authentication::Model::SAML2 for identity federation
• Environments using Net::SAML2 before 0.86 in combination with the above

Discovery Timeline

• 2026-09-06 - CVE-2026-86304 published to the National Vulnerability Database (NVD)
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86304

Vulnerability Analysis

The vulnerability breaks the trust model that SAML single sign-on depends on. parse_assertion calls Net::SAML2::Binding::POST->new without passing a trust anchor, so the POST binding has no configured certificate authority to validate the response signature. The returned XML is then handed to Net::SAML2::Protocol::Assertion->new_from_xml with the identity provider (IdP) signing certificate supplied as cacert. In Net::SAML2 before 0.86, that cacert parameter only gates decryption of encrypted assertions. Unencrypted assertions bypass that check entirely, leaving signature verification to fall back on the certificate embedded in the response document. See the MetaCPAN source for MojoX::Authentication::Model::SAML2 for the vulnerable code path.

Root Cause

The root cause is a missing trust anchor at the SAML POST binding layer combined with a misconception about which Net::SAML2 parameter enforces signature trust. The caller assumes cacert validates the assertion signature; in reality it only guards encrypted payloads, so unencrypted responses are trusted by their own embedded certificate.

Attack Vector

The attacker initiates a legitimate SAML login flow against the vulnerable relying party. They then post a forged SAML response signed with a certificate they control. The Audience, InResponseTo, and timestamp checks are all attacker-controlled fields that the forged response can satisfy. Because signature verification chains to the attacker's own certificate, the response authenticates whatever NameID the attacker chooses, including administrator identities.

No verified proof-of-concept code is published. Review the vulnerable
parse_assertion path referenced in the MetaCPAN source above and the
fix notes in the MojoX-Authentication 0.006 Changes file.

Detection Methods for CVE-2026-86304

Indicators of Compromise

• SAML responses whose embedded X509Certificate element does not match the configured IdP signing certificate fingerprint.
• Successful application logins for privileged NameID values without a corresponding authentication event in IdP logs.
• Unexpected InResponseTo values reused across sessions or issued from clients that never completed a real IdP redirect.

Detection Strategies

• Compare the certificate serial and thumbprint inside each inbound SAML response against the pinned IdP signing certificate and alert on mismatches.
• Reconcile relying-party session establishment events with IdP-side authentication logs to surface logins that lack a matching upstream assertion.
• Inventory Perl deployments for MojoX::Authentication releases below 0.006 and Net::SAML2 releases below 0.86 using package manifests such as cpanfile.snapshot or installed META.json files.

Monitoring Recommendations

• Enable verbose logging of SAML response signing certificates, issuers, and NameID values at the relying party.
• Forward web application and SAML handler logs to a centralized analytics tier to correlate impersonation attempts with source IPs and user agents.
• Monitor for privileged account activity that follows a SAML login but originates from anomalous geolocations or client fingerprints.

How to Mitigate CVE-2026-86304

Immediate Actions Required

• Upgrade MojoX::Authentication to version 0.006 or later on every host that processes SAML assertions.
• Upgrade Net::SAML2 to version 0.86 or later so that signature validation on unencrypted assertions is enforced by the library.
• Rotate any session tokens, API keys, or downstream credentials issued through the affected SAML flow while the vulnerability was exposed.
• Audit authentication logs for suspicious logins since the affected versions were deployed.

Patch Information

The fix ships in MojoX::Authentication0.006. Refer to the MojoX-Authentication 0.006 Changes file for release notes, and to the related CVE-2026-18089 record covering the underlying Net::SAML2 behavior addressed in version 0.86.

Workarounds

• If patching is not immediately possible, restrict access to the SAML assertion consumer endpoint using network controls or a reverse proxy allowlist.
• Require encrypted SAML assertions at the IdP so that the cacert parameter in the vulnerable code path is actually consulted.
• Terminate SAML validation at a hardened proxy or dedicated identity gateway that enforces trust anchor pinning before requests reach the Perl application.

# Upgrade the affected Perl modules to fixed versions
cpanm MojoX::Authentication@0.006
cpanm Net::SAML2@0.86

# Verify installed versions
perl -MMojoX::Authentication -e 'print $MojoX::Authentication::VERSION, "\n"'
perl -MNet::SAML2 -e 'print $Net::SAML2::VERSION, "\n"'