CVE-2026-9487 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
Attackers can bypass XML signature verification in Perl applications by using duplicate IDs, potentially controlling SAML assertions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9487?
CVE-2026-9487 is a critical vulnerability in TIMLEGGE XML::Sig, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.
Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
Weakness: CWE-347
Which versions are affected by CVE-2026-9487?
It affects 1 product.
Products include Xml\ \.
How do I fix CVE-2026-9487?
No fix has been published for CVE-2026-9487 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9487 being exploited?
There is no known exploitation of CVE-2026-9487 in the wild and no public exploit code.
Other vulnerabilities in TIMLEGGE XML::Sig
Sources
Also known as GHSA-wqp7-2ww4-q6mf.