Net::SAML2 versions earlier than 0.86 perform certificate validation based solely on the certificate embedded within a SAML response when no external trust anchor is supplied. The verification routine exits early after confirming the response signature, meaning that an attacker can supply a self‑signed certificate in the response’s KeyInfo element and have the library accept it as valid. This flaw allows an attacker to forge authenticated assertions and gain unauthorized access to services that rely on SAML for user authentication.

The vulnerability impacts Perl modules distributed by TIMLEGGE under the name Net::SAML2, affecting all releases prior to version 0.86. Any installation that does not enforce a trusted certificate store or provide a cacert/cert_text parameter when creating a POST binding or parsing an assertion is vulnerable.

Exploit is straightforward: an attacker constructs a SAML response signed with an arbitrary key, and the library accepts it without reference to a known trust anchor because none is configured. The CVSS score of 7.5 indicates high severity, capable of compromising authentication mechanisms. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the absence of external validation creates an attractive target for attackers. Proper mitigation requires configuring a valid trust anchor or updating the library.