---
id: CVE-2026-86304
title: >-
  MojoX::Authentication versions before 0.006 for Perl allow SAML authentication
  bypass because parse_assertion builds Net::SAML2::Binding::POST without a
  trust anchor.


  parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAM…
summary: >-
  MojoX::Authentication versions before 0.006 for Perl allow SAML authentication
  bypass because parse_assertion builds Net::SAML2::Binding::POST without a
  trust anchor.


  parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAM…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-347
product: MojoX-Authentication
affected:
  - MojoX-Authentication < 0.006
published: '2026-09-06'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:20:13.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86304'
references:
  - url: >-
      https://metacpan.org/release/POLETTIX/MojoX-Authentication-0.004/source/lib/MojoX/Authentication/Model/SAML2.pm#L188
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://metacpan.org/release/POLETTIX/MojoX-Authentication-0.006/source/Changes
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18089'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-08T18:41:21.191743Z'
epss: 0.00225
epssPercentile: 0.13502
ingestedAt: '2026-09-07T12:10:14.671Z'
---

## Overview

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.

parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries.

An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.