Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via "return $xml unless $xpath->exists('dsig:Signature', $assert);". The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted assertion with no dsig:Signature element reaches new_from_xml unverified and its NameID and attributes are read into the assertion object. An SP's encryption certificate is published in its SAML metadata so the IdP can encrypt to it, so any party can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and post it to the assertion consumer service. Any caller that configures a decryption key_file, and so accepts EncryptedAssertions, takes identity fields from an assertion that no trust a
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::SAML2 versions before 0.86 contain a critical authentication bypass vulnerability in the _verify_encrypted_assertion function. When processing encrypted SAML assertions, the library decrypts the content and returns it as verified without requiring a valid digital signature. This means an attacker can craft a malicious encrypted assertion, and as long as they can decrypt it (or provide an unencrypted decrypted form), the authentication checks and trust anchor validation are completely bypassed. This vulnerability affects any Perl-based application using Net::SAML2 for SAML 2.0 authentication, potentially allowing attackers to impersonate legitimate users and gain unauthorized access to protected resources.
While MITRE ATT&CK techniques aren't formally mapped to this CVE, Casky's security skills would identify this vulnerability through detection patterns aligned with credential and identity-based attacks. Practitioners using Casky would surface suspicious authentication flows where assertion validation succeeds despite missing cryptographic signatures—a red flag for CWE-347 (Improper Verification of Cryptographic Signature). The extended reasoning capabilities of Claude AI within Casky would help security teams correlate unusual SAML assertion patterns, detect multiple failed authentication attempts followed by successful ones using malformed assertions, and recognize the gap between encryption validation and signature enforcement. This allows defenders to catch both active exploitation attempts and vulnerable configurations before attackers establish persistent access through forged authentication tokens.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-18108. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation