CVE-2026-18092 is an improper verification of cryptographic signature vulnerability (CWE-347) in TIMLEGGE's Net::SAML2 Perl module versions before 0.86. The new_from_xml function reads SAML identity fields such as NameID and attributes using document-wide XPath queries that select the first matching element in document order, ignoring whether that element is covered by the verified XML signature. Although handle_response confirms the presence of a signature and validates the certificate chain when configured, XML::Sig only verifies the element referenced by the signature's URI. Consequently, unsigned sibling assertions in the same SAML response document are not covered by the signature. An attacker possessing any valid IdP-signed assertion can prepend an unsigned attacker-crafted assertion earlier in document order. The signature verification passes, but the system extracts identity fields from the attacker's unsigned assertion, enabling authentication bypass as an arbitrary user.

An attacker who holds any one valid IdP-signed assertion can bypass SAML authentication by injecting an unsigned assertion with attacker-controlled identity fields earlier in the document. This allows the attacker to impersonate arbitrary users despite the presence of valid signature verification and configured certificate trust anchors. The vulnerability undermines the integrity of SAML authentication in affected versions of Net::SAML2, potentially leading to unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted SAML Response documents to new_from_xml or implement additional validation to ensure that identity fields are extracted only from the signed assertion subtree. Monitor vendor channels for updates and apply patches promptly once released.