========================================================================
CVE-2026-9487                                        CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-9487
   Distribution:  XML-Sig
       Versions:  before 0.71

       MetaCPAN:  https://metacpan.org/dist/XML-Sig
       VCS Repo:  https://github.com/perl-net-saml2/perl-XML-Sig

XML::Sig versions before 0.71 for Perl allow signature wrapping via
duplicate ID

Description
-----------
XML::Sig versions before 0.71 for Perl allow signature wrapping via
duplicate ID.

_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the
SignedInfo Reference/@URI to a node with the XPath expression
"//*[@ID='$id']" and returns the first node of the resulting node set.
A document in which two elements share that ID value is accepted: the
digest and signature are checked against whichever element comes first
in document order, and the duplicate is not detected.

Such a document verifies successfully while an application that
resolves the same ID independently can read the second, attacker
supplied element; in a SAML2 context this places the contents of an
Assertion under attacker control.

Problem types
-------------
- CWE-347 Improper Verification of Cryptographic Signature

Workarounds
-----------
Signing the outermost <samlp:Response> element rather than only the
inner <saml:Assertion> reduces exposure, but does not prevent wrapping
variants in which the duplicate ID is introduced outside the signed
element. Upgrading to 0.71 is the complete fix.

Solutions
---------
Upgrade to version 0.71

References
----------
https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch
https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes