CVE-2026-18092 Auth bypass in Net::SAML2
Attackers can bypass SAML authentication and impersonate arbitrary users by exploiting XML signature wrapping in the Net::SAML2 Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-18092?
CVE-2026-18092 is a high-severity authentication bypass vulnerability in TIMLEGGE Net::SAML2, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree.
new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document order rather than the element covered by the verified signature. handle_response confirms that a signature is present and, when a cacert is configured, that it chains to the CA, but XML::Sig verifies only the element named by the signature's Reference URI, so unsigned sibling assertions in the same document are not covered. An attacker who holds any one IdP-signed assertion can add an unsigned attacker-authored assertion earlier in document order; the signature still verifies and the document-order XPath returns the attacker's NameID and attributes.
Any caller that passes an untrusted Response to new_from_xml can accept identity fields from an assertion the IdP never signed, even when a cacert trust anchor is configured, so a party holding one valid IdP-signed assertion can authenticate as an arbitrary user.
Weakness: CWE-347
Which versions are affected by CVE-2026-18092?
It affects 1 product.
Products include Timlegge Net\.
How do I fix CVE-2026-18092?
No fix has been published for CVE-2026-18092 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18092 being exploited?
There is no known exploitation of CVE-2026-18092 in the wild and no public exploit code.
Other vulnerabilities in TIMLEGGE Net::SAML2
Sources
Also known as GHSA-657v-xpf8-79x2.