CVE-2026-18089 Auth bypass in Net::SAML2
Attackers can bypass SAML authentication by embedding self-signed certificates in responses when no trust anchor is configured in the Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18089?
CVE-2026-18089 is a high-severity authentication bypass vulnerability in TIMLEGGE Net::SAML2, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.
verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with "return $xml unless $cacert;".
Any caller that constructs Binding::POST or calls Assertion->new_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.
Which versions are affected by CVE-2026-18089?
It affects 1 product.
Products include Timlegge Net\.
How do I fix CVE-2026-18089?
No fix has been published for CVE-2026-18089 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18089 being exploited?
There is no known exploitation of CVE-2026-18089 in the wild and no public exploit code.
Other vulnerabilities in TIMLEGGE Net::SAML2
Sources
Also known as GHSA-p5j9-p2w8-q5rw.