CVE-2026-9487
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
03/08/2026
Última modificación:
03/08/2026
Descripción
*** Pendiente de traducción *** XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.<br />
<br />
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID=&#39;$id&#39;]" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.<br />
<br />
Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
Impacto
Puntuación base 3.x
9.10
Gravedad 3.x
CRÍTICA