CVE-2026-18108 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...

SugarCRM php-saml Vulnerability

SugarCRM is prone to a signature validation vulnerability in php-saml. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Response Wrapping Attacks

Python3-saml is vulnerable to response wrapping attacks. These attacks are possible in environments supporting EncryptedAssertion. The signature validation didn't verify the the number of locations and signed elements matched the expected numbers...