CVE-2026-18108 is a critical vulnerability in Net::SAML2 versions prior to 0.86 where the _verify_encrypted_assertion function improperly verifies cryptographic signatures. Specifically, if an EncryptedAssertion decrypts to XML without a dsig:Signature element, the function returns the assertion as verified without performing signature or trust anchor checks. Since service providers publish their encryption certificates in SAML metadata, attackers can encrypt unsigned assertions to these certificates and submit them to the assertion consumer service, effectively bypassing authentication. This affects any caller that configures a decryption key_file to accept EncryptedAssertions. Callers without a key_file configured do not decrypt and are unaffected.

An unauthenticated attacker can bypass authentication by submitting encrypted assertions lacking valid cryptographic signatures. This leads to a complete compromise of authentication, allowing the attacker to impersonate arbitrary users. The vulnerability impacts confidentiality, integrity, and availability of the authentication process, with a CVSS score of 9.8 indicating critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring a decryption key_file to accept EncryptedAssertions if possible. Monitor vendor communications for an official fix or update to Net::SAML2 version 0.86 or later that addresses this issue.