Net::SAML2 versions before 0.86 allow an attacker to forge a SAML Response that contains an unsigned assertion before a signed IdP‑signable assertion. Because the library extracts identity fields with a document‑wide XPath, the first matching element is returned regardless of the signature coverage. An attacker who can provide an unsigned assertion with an attacker‑chosen NameID and attributes can therefore have the authentication library accept those values as valid identity, bypassing the intended IdP signature verification. This flaw leads to a full authentication bypass, granting the attacker the ability to assume the identity of any user the IdP could assert.

The vulnerability affects the Perl module Net::SAML2 (TIMLEGGE:Net::SAML2) for all releases prior to version 0.86. Systems using any of these earlier releases to process SAML responses are potentially exploitable, regardless of the operating system or Perl interpreter version.

The CVSS score is 8.1, indicating a high severity. No EPSS score is published and the vulnerability is not listed in CISA KEV, but the flaw enables a straightforward remote authentication bypass if an untrusted SAML Response can reach the application. The attack requires only that an attacker supply a crafted SAML document that includes both signed and unsigned assertions and that the application calls new_from_xml on the untrusted response. Because the bypass is independent of other conditions, the exploitability is high for affected deployments and the potential impact is total loss of authentication integrity.