CVE-2026-18089 affects Net::SAML2 versions prior to 0.86. The vulnerability arises from improper verification of cryptographic signatures (CWE-347) in the verify_xml method of Net::SAML2::Role::VerifyXML. When no trust anchor or CA certificate is configured, the function accepts the X.509 certificate embedded in the SAML response itself for signature verification. This allows an attacker to craft a response with a self-signed certificate embedded in the dsig:KeyInfo/dsig:X509Certificate element, bypassing authentication and accepting arbitrary assertions. The issue is particularly present when Binding::POST is constructed without specifying a cacert parameter, leading to unanchored verification.

An attacker can bypass SAML authentication by submitting a response signed with a self-signed certificate embedded in the response, effectively authenticating arbitrary assertions without possessing a valid trust anchor. This compromises the integrity of the authentication process, potentially allowing unauthorized access to systems relying on Net::SAML2 for SAML authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that all SAML response verifications are configured with proper trust anchors or CA certificates. Avoid using Binding::POST or Assertion->new_from_xml without specifying a trusted cacert, cert_text, or anchors parameter to prevent acceptance of untrusted certificates embedded in responses.