CVE-2026-9487 is a critical vulnerability in XML::Sig versions prior to 0.71 where improper verification of cryptographic signatures occurs due to duplicate ID values in XML documents. The function _get_signed_xml() uses an XPath expression to select the first node matching a given ID but does not detect duplicates. This allows an attacker to craft a document with two elements sharing the same ID, where the signature verification checks the first element but an application may process the second, attacker-controlled element. In SAML2 contexts, this can lead to assertion manipulation under attacker control. The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature) and has a CVSS 3.1 base score of 9.1 (critical).

An attacker can exploit this vulnerability to bypass signature verification by using duplicate ID values in XML documents, enabling signature wrapping attacks. This can lead to unauthorized manipulation of signed data, such as SAML2 assertions, potentially allowing attackers to impersonate users or escalate privileges. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing XML documents with duplicate ID attributes or implement additional checks to detect and reject documents containing duplicate IDs during signature verification.