Net::SAML2 vulnerabilities

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass. The _verify_encrypted_assertion function accepts a decrypted assertion without a signature, enabling an attacker to send an unsigned assertion encrypted with the SP's certificate and authenticate as any user.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass via XML signature wrapping. The new_from_xml function reads assertion identity using document-wide XPath instead of the signed subtree, allowing an attacker to prepend an unsigned assertion and assume a user's identity.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass by verifying responses against the response-embedded certificate when no trust anchor is configured. The verify_xml function accepts a response signed with an attacker's key, allowing authentication of an arbitrary assertion.