The vulnerability resides in the XML::Sig Perl module, where the verify function can return a positive result without performing any cryptographic checks. If an attacker supplies XML that contains Signature elements with a Reference URI that resolves to no element (or mismatches the requested ID when id_attr is set), the function skips digest verification entirely and ultimately returns true. The affected module versions are 0.29 through 0.71; versions 0.28 and earlier are unaffected. This weakness (CWE-347) allows an adversary to bypass signature validation, potentially forging authenticated messages or modifying XML documents accepted as valid.

Affected systems are installations of the Perl module XML::Sig from the author TIMLEGGE, specifically versions 0.29 up to 0.71. Any application that relies on this module to check the authenticity of XML data—such as SAML, WS‑Federation, or custom XML‑based protocols—may process unverified data if the module is in use. Versions up to 0.28 use an XML::XPath based verify that has no such skip and are not affected.

The risk is high because an attacker who can control the XML input to a victim system can cause it to accept tampered documents as authentic without any cryptographic evidence. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a verification step leaves systems vulnerable to replay or injection attacks. The exploit is a local or remote attack depending on the environment; any service that accepts XML data from a potentially untrusted source is a candidate for exploitation. The CVSS score of 7.5 indicates high severity.