The vulnerability exists in XML::Sig versions prior to 0.71, where the verification routine returns the first node matching a duplicate ID and accepts the document. This allows an attacker to craft an XML payload with two elements sharing an ID, so the original signed content is validated against the first element while the application may later read the second, attacker‑supplied element. In a SAML2 implementation this permits the attacker to replace the signed Assertion content, potentially granting unauthorized access or exfiltrating sensitive data.

The affected product is XML::Sig for Perl, distributed by the TIMLEGGE vendor. All releases prior to 0.71 are vulnerable; version 0.71 and later contain the fix.

The CVSS score is 9.1, indicating a critical severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation at the time of analysis. Nevertheless, the flaw allows an attacker to supply a malicious signed XML document that passes verification, a high‑impact attack if the application relies on the signed Assertion for authentication or authorization. The vulnerability can be exploited by any party capable of forming the XML payload; therefore the risk level is moderate to high, especially in environments where SAML assertions are used frequently.