The vulnerability in XML::Sig (CVE-2026-18568) arises from improper verification of cryptographic signatures (CWE-347). The verify function in lib/XML/Sig.pm counts Signature elements and iterates over them, but certain conditions cause the loop to skip signature checks without recording any verification. If all signatures are skipped—such as when Reference URIs do not resolve to elements or do not match requested IDs—the function returns true unconditionally, indicating successful verification despite no cryptographic validation. This flaw allows attackers to bypass signature verification when untrusted XML is processed. The issue affects versions from 0.29 up to but not including 0.72. Versions 0.28 and earlier are unaffected due to a different verification implementation.

An attacker can craft XML documents that bypass signature verification, causing the verify function to return true without any cryptographic checks. This can lead to acceptance of forged or tampered XML data as valid, potentially undermining trust in signed XML documents. The vulnerability affects applications relying on XML::Sig for signature validation, exposing them to risks of data integrity and authenticity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions (0.29 up to but not including 0.72) of XML::Sig for signature verification on untrusted XML data. Downgrading to version 0.28 or earlier, which uses a different verification method not affected by this issue, may be considered as a temporary mitigation. Monitor vendor communications for official patches or updates.