LiveActive security incident?Get immediate response
CVE Record

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Affected Perl applications can accept a forged SAML login signed with an attacker-controlled certificate. This could let an unauthenticated attacker impersonate any user identifier accepted by the application, potentially including privileged accounts. The issue affects MojoX::Authentication versions before 0.006 when using its SAML authentication path.

Executive priority

Treat as an immediate identity-security priority for affected SAML applications. A successful bypass could provide direct account impersonation without credentials or user action. Rapidly identify exposed deployments, upgrade them, and investigate suspicious SAML authentications. Systems not using this package or its SAML flow are not shown by the supplied evidence to be affected.

Technical view

MojoX::Authentication::Model::SAML2 creates Net::SAML2::Binding::POST without a trusted CA certificate, certificate text, or anchors. With Net::SAML2 before 0.86, unencrypted assertion signatures can consequently be validated against a certificate supplied within the response. Subsequent audience, request-correlation, and timestamp checks do not prevent the described authentication bypass.

Likely exposure

Exposure requires MojoX::Authentication before 0.006 and use of the affected SAML login flow. Internet-accessible SAML endpoints present the clearest risk. The supplied affected-product metadata is limited and internally unusual, so organizations should verify package versions and actual SAML usage rather than relying only on asset scanner matches.

Exploitation context

The described attack is remote, requires no prior privileges or user interaction, and can authenticate an attacker-selected NameID. The bundle reports a CVSS 3.1 score of 9.8. However, the CVE is not listed as KEV, and the provided sources do not establish active exploitation or public weaponization.

Researcher notes

The decisive condition is trust establishment for unencrypted assertion signatures, not merely presence of an IdP certificate later in assertion parsing. Confirm the installed MojoX::Authentication and Net::SAML2 versions, the assertion encryption mode, and the effective certificate-validation path. The bundle links CVE-2026-18089 as related, but does not explain that relationship sufficiently to extend affected-product conclusions.

Mitigation direction

  • Upgrade MojoX::Authentication to version 0.006 or later.
  • Review the 0.006 release notes and applicable vendor guidance before deployment.
  • Prioritize systems exposing the affected SAML login flow to untrusted networks.
  • Restrict access to affected SAML endpoints until remediation if business operations permit.

Validation and detection

  • Inventory Perl applications using MojoX::Authentication and record their installed versions.
  • Confirm whether each application enables MojoX::Authentication::Model::SAML2.
  • Verify affected systems have upgraded to MojoX::Authentication 0.006 or later.
  • In authorized staging, confirm assertions signed by untrusted certificates are rejected.
  • Review SAML authentication records for unexpected identities or unfamiliar signing certificates.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-347: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-86304 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
4Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-86304Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineCPANSec

    Version 0.006 released with fix.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorMojoX-AuthenticationMojoX-Authentication, 0unaffected
Weakness

CWE details

CWE-347

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-347 · source CWE mapping

Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs