The Net::SAML2 library incorrectly accepts decrypted EncryptedAssertions that lack a digital signature. Because the signature verification is bypassed, an attacker can forge an unsigned assertion, encrypt it with the service provider’s certificate, and send it to the Assertion Consumer Service, causing the library to unconditionally populate the user identity fields. This allows the issuer to authenticate as any arbitrary user without authentication, constituting a CWE‑347 design flaw.

The vulnerability affects the Net::SAML2 library from the TIMLEGGE vendor, specifically all versions earlier than 0.86. Versions 0.86 and later implement stricter checks that require the signature to chain to a trusted anchor.

The flaw poses a high‑risk authentication bypass that receives a CVSS score of 9.8 and can be exploited remotely over HTTPS by an unauthenticated attacker who can acquire or construct an unsigned SAML response. The EPSS score is not available, but the lack of signature protection makes exploitation straightforward once the service is misconfigured to decrypt assertions. The vulnerability is not listed in CISA’s KEV catalog. Attackers could claim arbitrary identities and potentially gain privileged access to protected resources.