CVE-2026-9487: XML::Sig for Perl XXE Vulnerability

CVE-2026-9487 Overview

CVE-2026-9487 is an XML Signature Wrapping (XSW) vulnerability in the Perl module XML::Sig at versions prior to 0.71. The flaw resides in the _get_signed_xml() routine within lib/XML/Sig.pm, which resolves a SignedInfo reference using the XPath expression //*[@ID='$id'] and returns only the first matching node. When two elements share the same ID, the signature validates against the first element while downstream consumers may parse the second, attacker-controlled element. In a SAML2 (Security Assertion Markup Language) context, this places Assertion contents under attacker control [CWE-347].

Critical Impact
An attacker can forge a signed SAML assertion that verifies successfully while injecting attacker-controlled identity or authorization data, enabling authentication bypass in SSO deployments.

Affected Products

XML::Sig Perl module versions before 0.71
Perl applications using XML::Sig for XML signature verification
SAML2 service providers built on Net::SAML2 and similar stacks that depend on XML::Sig

Discovery Timeline

2026-08-03 - CVE-2026-9487 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-9487

Vulnerability Analysis

The vulnerability is a classic XML Signature Wrapping attack enabled by ambiguous ID resolution. XML::Sig accepts a signed XML document containing two elements that carry the same ID attribute value. During verification, _get_signed_xml() calls findvalue('//*[@ID=\'$reference\']') and returns the first matching node in document order. The digest and cryptographic signature check succeed against that first element.

Downstream consumers, such as SAML2 relying parties that independently locate the Assertion element by ID, may resolve the second occurrence. The signed content and the consumed content diverge. This mismatch allows an attacker to embed a forged Assertion whose Subject, AttributeStatement, or authorization claims replace the legitimate ones without invalidating the signature.

Root Cause

The root cause is failure to enforce ID uniqueness during signature reference resolution. XML Digital Signature semantics require that a URI reference resolve to exactly one element, but XML::Sig did not validate the size of the resulting node set. The fix rejects any document in which the reference resolves to more or fewer than one node.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker who obtains any legitimately signed XML document, such as a captured SAML Response, can clone the signed Assertion, keep it intact to preserve the digest, and append a duplicate Assertion carrying the same ID with attacker-chosen content. The verifier confirms the signature on the first element; the SAML consumer reads the second.

text

// Security patch in lib/XML/Sig.pm - Reject Duplicate IDs in XML document
             next;
         }
 
-        # The reference ID must point to something in the document
-        # if not disregard it and look for another signature
-        # TODO check to ensure that if there is only a single reference
-        # like this it won't accidentally validate
-        if (! $parser->findvalue('//*[@ID=\''. $reference . '\']')) {
-            print ("   Signature reference $reference is not signing anything in this xml\n") if $DEBUG;
+
+        # The reference ID must point to exactly ONE element in the document.
+        # If zero, the signature signs nothing.  If more than one, the
+        # document is ambiguous and vulnerable to XML Signature Wrapping
+        # (XSW) attacks - the signature could validate against one element
+        # while a caller extracts a different element with the same ID.
+        # See USENIX Security 2012 "On Breaking SAML" (Somorovsky et al)
+        # and CVE-2025-29774 (xml-crypto).
+        my $ref_nodes = $self->{ parser }->findnodes(
+            '//*[@ID=\''. $reference . '\']');
+        my $ref_count = $ref_nodes->size();
+        if ($ref_count == 0) {
+            print "   Signature reference $reference is not signing anything in this xml\n"
+                if $DEBUG;
             if ($numsigs <= 1) {
                 return 0;
             }

Source: GitHub Commit Patch

Detection Methods for CVE-2026-9487

Indicators of Compromise

SAML Response or generic signed XML payloads containing more than one element with the same ID attribute value.
Multiple <saml:Assertion> elements in a single Response, especially when one appears outside the element covered by SignedInfo/Reference/@URI.
Authentication events where the asserted Subject or AttributeStatement differs from the identity recorded upstream at the identity provider.

Detection Strategies

Parse inbound signed XML with a schema-aware validator and reject documents where any ID value appears more than once.
Inventory Perl applications for XML::Sig versions older than 0.71 using CPAN metadata or the output of cpanm --info XML::Sig.
Log the canonicalized bytes actually covered by the signature and compare them against the bytes consumed by the SAML layer.

Monitoring Recommendations

Alert on SAML sign-ins where the same AssertionID recurs across sessions or where downstream logs show a Subject inconsistent with IdP-side records.
Monitor network traffic to SAML Assertion Consumer Service (ACS) endpoints for anomalously large SAMLResponse payloads that may contain injected duplicate assertions.
Track dependency graphs so any upstream advisory on XML::Sig or Net::SAML2 triggers a review of authentication paths.

How to Mitigate CVE-2026-9487

Immediate Actions Required

Upgrade XML::Sig to version 0.71 or later on every host that verifies XML signatures.
Audit all Perl SAML2 service providers, including deployments using Net::SAML2, and redeploy after patching.
Rotate SAML signing keys and invalidate active sessions if log review suggests exploitation attempts against ACS endpoints.

Patch Information

The upstream fix is available in the GitHub Commit Patch and shipped in release 0.71, as recorded in the MetaCPAN Release Changes. The patch replaces the boolean findvalue check with a findnodes call and rejects any document where the reference ID resolves to zero or more than one node.

Workarounds

If immediate upgrade is not possible, wrap verify() in a preprocessing step that parses the document with XML::LibXML and rejects it when any ID attribute value occurs more than once.
Restrict SAML acceptance to identity providers that emit exactly one Assertion per Response and enforce this constraint at the application layer.
Deploy schema validation that requires ID attributes to be typed as xs:ID, causing conformant parsers to reject duplicates.

bash

# Upgrade XML::Sig to the patched release
cpanm XML::Sig@0.71

# Verify installed version
perl -MXML::Sig -e 'print "$XML::Sig::VERSION\n"'