{"id":4378,"date":"2026-09-04T18:46:27","date_gmt":"2026-09-04T10:46:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-18089"},"modified":"2026-09-04T18:46:27","modified_gmt":"2026-09-04T10:46:27","slug":"cve-2026-18089","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-18089","title":{"rendered":"CVE-2026-18089 [HIGH] &#8211; Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying res"},"content":{"rendered":"<p>Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.<\/p>\n<p>verify_xml in Net::SAML2::Role::VerifyXML runs &#8220;return if !$anchors &amp;&amp; !$cacert;&#8221; as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response&#8217;s own dsig:KeyInfo\/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with &#8220;return $xml unless $cacert;&#8221;.<\/p>\n<p>Any caller that constructs Binding::POST or calls Assertion-&gt;new_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.<\/p>\n<p>verify_xml<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4378","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}