What is CVE-2026-18108?
CVE-2026-18108 is an authentication bypass vulnerability in Net::SAML2 for Perl versions before 0.86. The `_verify_encrypted_assertion` function incorrectly treats a decrypted `EncryptedAssertion` without a signature as valid, potentially allowing unauthorized access. Affected users should update to version 0.86 immediately to mitigate the risk.
Azərbaycanca: CVE-2026-18108 Perl üçün Net::SAML2 kitabxanasının 0.86-dan əvvəlki versiyalarında autentifikasiyadan yan keçmə zəifliyidir. `_verify_encrypted_assertion` funksiyası şifrəsi açılmış `EncryptedAssertion`-da imza olmadıqda onu avtomatik təsdiqləyir, bu da təcavüzkarın sistemə icazəsiz girişinə səbəb ola bilər. Təsirə məruz qalan təşkilatlar dərhal 0.86 versiyasına yeniləmə etməlidir.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
How does CVE-2026-18108 allow an authentication bypass in the Net::SAML2 library?
The vulnerability lies in a logic flaw within the `_verify_encrypted_assertion` function, which automatically treats a decrypted `EncryptedAssertion` as valid even when it lacks a signature, enabling an attacker to craft a malicious assertion to gain unauthorized access.
To what version must Net::SAML2 be updated to mitigate CVE-2026-18108?
To mitigate this vulnerability, users must update the Net::SAML2 library for Perl to version 0.86 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.