Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document…

CVE-2026-18092 affects Net::SAML2 versions before 0.86 for Perl, allowing SAML authentication bypass through XML signature wrapping. The vulnerability exists because the new_from_xml function reads identity fields (NameID, attributes, SessionIndex, audience) using document-wide XPath queries rather than restricting lookups to the signed XML subtree. The handle_response function verifies that a signature is present and chains to a CA, but XML::Sig only verifies the element referenced by the signature's Reference URI, leaving unsigned sibling assertions unchecked. An attacker who possesses any valid IdP-signed assertion can inject an unsigned, attacker-crafted assertion earlier in document order, causing the XPath queries to return the attacker's identity fields while the signature still validates. This allows an attacker to authenticate as an arbitrary user, effectively bypassing the SAML trust model entirely. The fix is available in Net::SAML2 version 0.86.