CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication versions before 0.006 for Perl are vulnerable to a SAML authentication bypass (CWE-347): parse_assertion in MojoX::Authentication::Model::SAML2 builds Net::SAML2::Binding::POST without a trust anchor (no cacert, cert_text or anchors argument), and with Net::SAML2 before 0.86 the signature on an unencrypted assertion is checked against the certificate the response itself carries rather than a configured IdP certificate. An attacker initiates a SAML login at a vulnerable application and then posts a SAML response signed with a certificate of their own; the subsequent audience, InResponseTo and timestamp checks are all satisfiable by the attacker. The response therefore authenticates any NameID the attacker chooses, letting them access any account the application maps to that identifier without possessing IdP credentials. Any Perl/Mojolicious application using MojoX::Authentication's SAML2 model for login is affected, and the flaw is rated critical (CVSS 3.1 9.8). No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns a roughly 0.2% probability of exploitation within 30 days (13th percentile), indicating no known in-the-wild exploitation.

Do: Upgrade MojoX::Authentication to 0.006 or later and also upgrade Net::SAML2 to 0.86 or later so unencrypted assertion signatures are verified against the configured IdP trust anchor. Until patched, disable or restrict SAML-based login on affected applications and review authentication logs for logins whose signing certificate is not your IdP's. Check whether your deployment uses MojoX::Authentication::Model::SAML2 with unencrypted assertions, which is the exposed code path.