XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.

_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the Signe…

CVE-2026-9487 affects XML::Sig versions before 0.71 for Perl, allowing signature wrapping attacks via duplicate XML element IDs. The vulnerability exists in the _get_signed_xml() function within lib/XML/Sig.pm, which uses an XPath expression to resolve SignedInfo Reference URIs but only checks the first matching node in document order. An attacker can craft a document with two elements sharing the same ID value, where the legitimate element passes signature verification while a second attacker-controlled element goes undetected. In a SAML2 context, this allows an attacker to place arbitrary content inside an Assertion, effectively bypassing authentication or authorization controls. The flaw is fixed in XML::Sig version 0.71, with a patch available via the perl-net-saml2 GitHub repository. This is a classic XML Signature Wrapping (XSW) attack and carries significant risk for any application relying on XML digital signatures for trust decisions.