Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

oss-security ()1 · 1 read
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

Key facts
  • SAML assertions parsed without a trust anchor enable bypass
  • Fixed in MojoX::Authentication 0.006
  • Reported to oss-security by Timothy Legge
  • Affects Perl applications relying on this module for SAML
Analyze CVE-2026-86304 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-86304
Tags
authentication-bypassmojox-authenticationnet-saml2perlsaml
Vendors
MojoX::AuthenticationNet::SAML2
Products
MojoX::Authentication

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86304
SAML Authentication Bypass in MojoX::Authentication for Perl
9.8<1%

From the original article

Posted by Timothy Legge on Sep 06 ======================================================================== https://metacpan. org/dist/MojoX-Authentication MojoX::Authentication versions before 0. 006 for Perl allow...

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.