Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: TIMLEGGE Net::SAML2 0.86 Clear all filters
TI-2026-14891 CVE-2026-18092 · GHSA-657v-xpf8-79x2

Improper signature verification in TIMLEGGE Net::SAML2

Priority LOW 35

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00337 Published 2026-08-03 Fixed in 0.86 CWE-347
TI-2026-14905 CVE-2026-18108 · GHSA-g48m-j5m7-625h

Improper signature verification in TIMLEGGE Net::SAML2

Priority MEDIUM 49

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-08-03 Fixed in 0.86 CWE-347
TI-2026-14889 CVE-2026-18089 · GHSA-p5j9-p2w8-q5rw

Improper certificate validation in TIMLEGGE Net::SAML2

Priority LOW 38

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00234 Published 2026-08-03 Fixed in 0.86 CWE-295