CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "XML-Sig",
    "product": "XML::Sig",
    "programFiles": [
      "lib/XML/Sig.pm"
    ],
    "programRoutines": [
      {
        "name": "XML::Sig::verify"
      }
    ],
    "repo": "https://github.com/perl-net-saml2/perl-XML-Sig",
    "vendor": "TIMLEGGE",
    "versions": [
      {
        "lessThan": "0.72",
        "status": "affected",
        "version": "0.29",
        "versionType": "custom"
      }
    ]
  }
]