{"id":4380,"date":"2026-09-04T18:46:27","date_gmt":"2026-09-04T10:46:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-18108"},"modified":"2026-09-04T18:46:27","modified_gmt":"2026-09-04T10:46:27","slug":"cve-2026-18108","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-18108","title":{"rendered":"CVE-2026-18108 [CRITICAL] &#8211; Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encry"},"content":{"rendered":"<p>Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.<\/p>\n<p>_verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via &#8220;return $xml unless $xpath-&gt;exists(&#8216;dsig:Signature&#8217;, $assert);&#8221;. The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted assertion with no dsig:Signature element reaches new_from_xml unverified and its NameID and attributes are read into the assertion object. An SP&#8217;s encryption certificate is published in its SAML metadata so the IdP can encrypt to it, so any party can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and post it to the assertion consumer service.<\/p>\n<p>Any caller that configures a decryption key_file, and so accepts EncryptedAssertions, takes identity fields from an assertion that no trust anchor covers, and an unauthenticated party can authenticate as an arbitrary user. Callers with no key_file configured do not decrypt and are unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.<\/p>\n<p>_verify_encrypted_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4380","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}