The vulnerability in Net::SAML2 <0.86 arises because the _verify_encrypted_assertion method accepts EncryptedAssertions whose decrypted content lacks a dsig:Signature element and returns them as verified without performing signature or trust anchor checks. Since the service provider's encryption certificate is publicly available in SAML metadata, an attacker can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and submit it to the assertion consumer service. This leads to authentication bypass by allowing an unauthenticated party to impersonate any user. The flaw only affects configurations that use a decryption key_file to accept EncryptedAssertions.

An attacker can bypass authentication by submitting encrypted assertions without valid signatures, which the vulnerable Net::SAML2 versions treat as verified. This allows unauthorized access and impersonation of arbitrary users in affected deployments configured to decrypt assertions. Systems not configured with a decryption key_file are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring Net::SAML2 with a decryption key_file to prevent acceptance of unsigned encrypted assertions. Monitor vendor communications for an official fix or update.