456 matches found
CVE-2026-9487
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...
CVE-2026-9487
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...
CVE-2026-18108
The Net::SAML2 Perl module (versions before 0.86 ) is vulnerable to an authentication bypass due to improper verification of cryptographic signatures. The root cause lies in the _verify_encrypted_assertion function, which returns a decrypted assertion as verified if it lacks a dsig:Signature elem...
CVE-2026-18108 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...
CVE-2026-18108 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...
CVE-2026-18108
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...
CVE-2026-18089 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
CVE-2026-18089
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
CVE-2026-18089 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
CVE-2026-18089: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...
CVE-2026-18108: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...
CVE-2026-18092: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...
CVE-2026-9487: Improper Verification of Cryptographic Signature
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...
PT-2026-67393
Name of the Vulnerable Software and Affected Versions Net::SAML2 versions prior to 0.86 Description An authentication bypass exists when no trust anchor is configured. The verify xml function in Net::SAML2::Role::VerifyXML allows responses to be verified against the certificate embedded within th...
Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Overview Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' through the XPath Transform process. An attacker can cause the application to become unresponsive or crash by sending specially crafted messages that exploit thi...
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without...
com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)
org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-40988 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633...
ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)
org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...
ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)
org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...
com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)
org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-41003 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632...