CVE-2026-18108

{
  "id": "CVE-2026-18108",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-08-03T14:16:25.157",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.\n\n_verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via \"return $xml unless $xpath->exists('dsig:Signature', $assert);\". The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted assertion with no dsig:Signature element reaches new_from_xml unverified and its NameID and attributes are read into the assertion object. An SP's encryption certificate is published in its SAML metadata so the IdP can encrypt to it, so any party can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and post it to the assertion consumer service.\n\nAny caller that configures a decryption key_file, and so accepts EncryptedAssertions, takes identity fields from an assertion that no trust anchor covers, and an unauthenticated party can authenticate as an arbitrary user. Callers with no key_file configured do not decrypt and are unaffected."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::SAML2 anteriores a la 0.86 para Perl permiten la omisión de autenticación porque _verify_encrypted_assertion acepta una EncryptedAssertion cuyo contenido descifrado no lleva firma.\n\n_verify_encrypted_assertion descifra la EncryptedAssertion y la devuelve como verificada cuando no lleva firma, a través de “return $xml unless $xpath  ->  exists(’dsig:Signature’, $assert);”. La comprobación de firma y la comprobación de anclaje de confianza que le siguen se ejecutan solo cuando hay una firma presente, por lo que una aserción descifrada sin un elemento dsig:Signature llega a new_from_xml sin verificar y su NameID y atributos se leen en el objeto de aserción. El certificado de cifrado de un SP se publica en sus metadatos SAML para que el IdP pueda cifrar a él, por lo que cualquier parte puede cifrar una aserción sin firmar a ese certificado, envolverla en una samlp:Response y publicarla en el servicio de consumidor de aserciones.\n\nCualquier llamador que configure un archivo de clave de descifrado, y por lo tanto acepta EncryptedAssertions, toma campos de identidad de una aserción que ningún anclaje de confianza cubre, y una parte no autenticada puede autenticarse como un usuario arbitrario. Los llamadores sin un key_file configurado no descifran y no se ven afectados."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "TIMLEGGE",
          "product": "Net::SAML2",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Net-SAML2",
          "programFiles": [
            "lib/Net/SAML2/Protocol/Assertion.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::SAML2::Protocol::Assertion::_verify_encrypted_assertion"
            },
            {
              "name": "Net::SAML2::Protocol::Assertion::new_from_xml"
            }
          ],
          "repo": "https://github.com/perl-net-saml2/perl-Net-SAML2",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.86",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-03T19:57:16.653167Z",
          "id": "CVE-2026-18108",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:timlegge:net\\:\\:saml2:*:*:*:*:*:perl:*:*",
              "versionEndExcluding": "0.86",
              "matchCriteriaId": "69FF1709-62F7-4E8C-B90D-ABFA96B07FF1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/perl-net-saml2/perl-Net-SAML2/commit/d916468586404518b8cf3c78dbd001cc1f1046a7.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Protocol/Assertion.pm#L78",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.86/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ]
    }
  ]
}