Net::SAML2 — Vulnerabilities & Security Advisories 3

All 3 CVE vulnerabilities found in Net::SAML2, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-18092	Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree CWE-347	-	-	2026-08-03
CVE-2026-18108	Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature CWE-347	-	-	2026-08-03
CVE-2026-18089	Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured CWE-347	-	-	2026-08-03

All 3 known CVE vulnerabilities affecting Net::SAML2 with full Chinese analysis, references, and POCs where available.