THREATOPS

THREAT OPS › Threat News › CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

medoss_secPublished 2026-09-06

Posted by Timothy Legge on Sep 06======================================================================== CVE-2026-86304 CPAN Security Group ======================================================================== CVE ID: CVE-2026-86304 Distribution: MojoX-Authentication Versions: before 0.006<b

Indicators of compromise

CVE-2026-86304cve
https://metacpan.org/dist/MojoX-Authenticationurl

Original source: https://seclists.org/oss-sec/2026/q3/662

Same event, other sources

[NVD] CVE-2026-86304 — MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, certnvd · 2026-09-06