{"id":17917,"date":"2026-09-07T08:30:34","date_gmt":"2026-09-07T00:30:34","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86304"},"modified":"2026-09-07T08:30:34","modified_gmt":"2026-09-07T00:30:34","slug":"cve-2026-86304","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86304","title":{"rendered":"CVE-2026-86304 &#8211; MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass beca"},"content":{"rendered":"<p>MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.<\/p>\n<p>parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-&gt;new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion-&gt;new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries.<\/p>\n<p>An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.<\/p>\n<p>parse_assertion in MojoX::Authen<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17917","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17917"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17917"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}