Threat Intelligence Database

Net::SAML2 versions before 0.86 for Perl contain a vulnerability that allows SAML authentication bypass via XML signature wrapping. The issue arises because the new_from_xml function reads identity fields using document-wide XPath expressions rather than restricting to the signed subtree, enabling attackers to inject unsigned assertions that appear valid. This flaw allows an attacker with a valid IdP-signed assertion to authenticate as any arbitrary user.

Net::SAML2 versions before 0.86 for Perl contain a critical vulnerability that allows authentication bypass. The vulnerability arises because the _verify_encrypted_assertion function accepts encrypted assertions without verifying cryptographic signatures if no signature element is present. This allows unauthenticated attackers to forge assertions encrypted to a service provider's encryption certificate and authenticate as arbitrary users. Systems that do not configure a decryption key_file are not affected.

Net::SAML2 versions before 0.86 for Perl contain a vulnerability that allows SAML authentication bypass. The verify_xml function verifies responses against a certificate embedded within the response itself when no trust anchor is configured, enabling attackers to authenticate arbitrary assertions using self-signed certificates. This occurs because the code returns early if no trust anchors or CA certificates are provided, trusting the embedded certificate without external validation.