EUVD-2026-52268

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...

CVE-2026-18108 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...

CVE-2026-18108

The Net::SAML2 Perl module (versions before 0.86 ) is vulnerable to an authentication bypass due to improper verification of cryptographic signatures. The root cause lies in the _verify_encrypted_assertion function, which returns a decrypted assertion as verified if it lacks a dsig:Signature elem...