CVE-2026-9487 Details
Description
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
A vulnerability in XML::Sig versions prior to 0.71 for Perl allows for signature wrapping through duplicate ID references. The issue arises in the signature verification process, where the library's XPath expression resolves to a node set based on the ID attribute. If two elements share the same ID, the library only verifies the first one, leaving the duplicate unaccounted for. This flaw can be exploited in a SAML2 context, allowing an attacker to manipulate the contents of an Assertion.
Users should update to XML::Sig version 0.71 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch | CPANSec | Patch |
| https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes | CPANSec | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| xml::sig project xml::sig | < 0.71 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | CPANSec |