CVE-2026-86304: CWE-347 Improper Verification of Cryptographic Signature

The vulnerability in MojoX::Authentication versions before 0.006 involves improper verification of cryptographic signatures (CWE-347) in SAML authentication. Specifically, parse_assertion calls Net::SAML2::Binding::POST->new without specifying trust anchors, and in Net::SAML2 versions before 0.86, the IdP signing certificate only protects encrypted assertions. Consequently, the signature on unencrypted assertions is validated against the certificate included in the response itself, which an attacker can control. This enables an attacker to submit a SAML response signed with a self-generated certificate, passing audience, InResponseTo, and timestamp checks, thereby authenticating any NameID they choose.

Successful exploitation allows an unauthenticated attacker to bypass SAML authentication and impersonate any user by forging a SAML response signed with their own certificate. This leads to complete compromise of authentication integrity, resulting in full confidentiality, integrity, and availability impact on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of MojoX::Authentication and Net::SAML2 or implement additional signature verification controls if possible.