The vulnerability resides in the MojoX::Authentication module prior to version 0.006. The parse_assertion routine constructs a Net::SAML2::Binding::POST object without specifying a trust anchor, causing the signature on a SAML assertion to be validated against a certificate embedded in the assertion itself. An attacker can therefore forge a signed SAML response, satisfying audience, InResponseTo, and timestamp checks, and authenticate as any arbitrary user. This flaw is classed as CWE-347 and allows an attacker to obtain unauthorized access without needing valid credentials.

All installations of the Perl module MojoX::Authentication that are at a version older than 0.006 are vulnerable. No other products or vendors are known to be affected according to the CNA data.

The vulnerability is a high‑severity authentication bypass with a CVSS score of 9.8. Though the EPSS score is low (< 1%) and it is not listed in KEV, the logical exploitation path is straightforward: initiate a SAML login flow and submit a forged assertion. The attacker only needs the ability to post an HTTP request to the SAML endpoint; no privileged server access or additional credentials are required. Given the critical nature of authentication, the risk is substantial should the environment rely on the affected module.