CVE-2026-18092

Net::SAML2 for Perl is affected prior to version 0.86. The vulnerability arises because new_from_xml reads assertion identity (NameID, attributes, SessionIndex, etc.) using document-wide XPath (e.g., //saml:Assertion/saml:AttributeStatement/saml:Attribute, //saml:Subject/saml:NameID) instead of t...