{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Net-SAML2",
          "product": "Net::SAML2",
          "programFiles": [
            "lib/Net/SAML2/Protocol/Assertion.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::SAML2::Protocol::Assertion::_verify_encrypted_assertion"
            },
            {
              "name": "Net::SAML2::Protocol::Assertion::new_from_xml"
            }
          ],
          "repo": "https://github.com/perl-net-saml2/perl-Net-SAML2",
          "vendor": "TIMLEGGE",
          "versions": [
            {
              "lessThan": "0.86",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:timlegge:net\\:\\:saml2:*:*:*:*:*:perl:*:*",
              "matchCriteriaId": "69FF1709-62F7-4E8C-B90D-ABFA96B07FF1",
              "versionEndExcluding": "0.86",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.\n\n_verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via \"return $xml unless $xpath-\u003eexists(\u0027dsig:Signature\u0027, $assert);\". The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted assertion with no dsig:Signature element reaches new_from_xml unverified and its NameID and attributes are read into the assertion object. An SP\u0027s encryption certificate is published in its SAML metadata so the IdP can encrypt to it, so any party can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and post it to the assertion consumer service.\n\nAny caller that configures a decryption key_file, and so accepts EncryptedAssertions, takes identity fields from an assertion that no trust anchor covers, and an unauthenticated party can authenticate as an arbitrary user. Callers with no key_file configured do not decrypt and are unaffected."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::SAML2 anteriores a la 0.86 para Perl permiten la omisi\u00f3n de autenticaci\u00f3n porque _verify_encrypted_assertion acepta una EncryptedAssertion cuyo contenido descifrado no lleva firma.\n\n_verify_encrypted_assertion descifra la EncryptedAssertion y la devuelve como verificada cuando no lleva firma, a trav\u00e9s de \u201creturn $xml unless $xpath  -\u003e  exists(\u2019dsig:Signature\u2019, $assert);\u201d. La comprobaci\u00f3n de firma y la comprobaci\u00f3n de anclaje de confianza que le siguen se ejecutan solo cuando hay una firma presente, por lo que una aserci\u00f3n descifrada sin un elemento dsig:Signature llega a new_from_xml sin verificar y su NameID y atributos se leen en el objeto de aserci\u00f3n. El certificado de cifrado de un SP se publica en sus metadatos SAML para que el IdP pueda cifrar a \u00e9l, por lo que cualquier parte puede cifrar una aserci\u00f3n sin firmar a ese certificado, envolverla en una samlp:Response y publicarla en el servicio de consumidor de aserciones.\n\nCualquier llamador que configure un archivo de clave de descifrado, y por lo tanto acepta EncryptedAssertions, toma campos de identidad de una aserci\u00f3n que ning\u00fan anclaje de confianza cubre, y una parte no autenticada puede autenticarse como un usuario arbitrario. Los llamadores sin un key_file configurado no descifran y no se ven afectados."
    }
  ],
  "id": "CVE-2026-18108",
  "lastModified": "2026-10-23T21:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18108",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-03T19:57:16.653167Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-03T14:16:25.157",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/perl-net-saml2/perl-Net-SAML2/commit/d916468586404518b8cf3c78dbd001cc1f1046a7.patch"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Product"
      ],
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Protocol/Assertion.pm#L78"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ],
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.86/changes"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    }
  ]
}