CVE-2026-86304 MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::PO
Attackers can bypass SAML authentication in MojoX::Authentication by submitting forged responses, leading to unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86304?
CVE-2026-86304 is a critical authentication bypass vulnerability, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.
parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries.
An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.
Weakness: CWE-347
Which versions are affected by CVE-2026-86304?
How do I fix CVE-2026-86304?
No fix has been published for CVE-2026-86304 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-86304 being exploited?
There is no known exploitation of CVE-2026-86304 in the wild and no public exploit code.
Sources
Also known as GHSA-34pg-3x4x-4vf5.