Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document order rather than the element covered by the verified signature. handle_response confirms that a signature is present and, when a cacert is configured, that it chains to the CA, but XML::Sig verifies only the element named by the signature's Reference URI, so unsigned sibling assertions in the same document are not covered. An attacker who holds any one IdP-signed assertion can add an unsigned attacker-authored assertion earlier in document order; the signature still verifies and the document-order XPath returns the at
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::SAML2 versions before 0.86 contain a critical XML signature validation flaw that allows attackers to bypass SAML authentication entirely. The vulnerability stems from improper XPath evaluation in the new_from_xml function, which reads identity assertion fields using document-wide XPath queries instead of validating elements within the signed subtree. This means attackers can inject malicious XML elements elsewhere in the SAML response that get selected and processed as legitimate identity claims, completely circumventing the cryptographic signature protections that SAML is designed to provide. Organizations using vulnerable versions of this Perl library for single sign-on (SSO) or federated identity validation are at immediate risk of unauthorized access, as attackers can forge authentication claims without possessing the signing keys.
While this CVE currently maps to zero Casky skills due to its focus on Perl-specific XML parsing rather than broad ATT&CK techniques, Casky's Claude-powered analysis would detect the underlying attack pattern: Adversary-in-the-Middle (T1557) combined with Identity Provider Exploitation. Practitioners using Casky would see detections flagging anomalous SAML assertion structures where unsigned XML elements appear alongside signed assertions, or cases where NameID and AttributeStatement values originate from unexpected positions in the XML document tree. The extended reasoning capability would correlate suspicious authentication flows with malformed SAML responses, identifying the signature wrapping technique before fraudulent access is granted. Immediate remediation requires upgrading Net::SAML2 to version 0.86 or later and auditing all SAML-based authentications in logs for suspicious identity claims.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-18092. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation