The vulnerability in Net::SAML2 (CVE-2026-18092) is due to improper verification of cryptographic signatures (CWE-347). The new_from_xml function reads identity attributes such as NameID and SessionIndex using document-wide XPath queries, which select the first matching element in document order rather than the element covered by the verified signature. Although handle_response confirms the presence of a signature and validates the certificate chain, XML::Sig verifies only the element referenced by the signature's URI. This allows an attacker to prepend an unsigned, attacker-controlled assertion earlier in the document, which is returned by the XPath queries despite not being signed. Consequently, callers passing untrusted Responses to new_from_xml may accept identity fields from unsigned assertions, enabling authentication bypass as arbitrary users.

An attacker who possesses any valid IdP-signed assertion can craft a SAML Response containing an unsigned assertion with attacker-controlled identity fields placed earlier in document order. Because the signature verification only covers the signed assertion, the unsigned assertion is accepted by new_from_xml due to document-wide XPath queries. This results in authentication bypass, allowing the attacker to impersonate arbitrary users. The vulnerability impacts the integrity of SAML authentication and can lead to unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted SAML Responses to new_from_xml or implement additional validation to ensure identity fields are extracted only from the signed assertion subtree. Monitor vendor communications for an official fix or update.