CVE-2026-18108

CVE-2026-18108 affects Net::SAML2 for Perl versions before 0.86. A bug in _verify_encrypted_assertion decrypts an EncryptedAssertion and returns it as verified if it carries no dsig:Signature, bypassing signature/trust checks. As a result, an unsigned assertion can be decrypted and its NameID/att...