Intel

CVE-2026-9487

\: Improper Verification of Cryptographic Signature (CVE-2026-9487)

criticalEPSS 0.3%

Affected

  • xml\/\ lt *..0.71

Description

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.

Source: NVD (NIST)CVE.org (MITRE)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

xml\\
0.71fixed from 0.71

Metrics

XIEM Effective CVSS
9.1
Source: nvd-v3
EPSS percentile
18.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
critical
Priority score
72.28
Exploit maturity
no public PoC known
CVSS v3
9.1
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-03 14:16 UTC
CWE
CWE-347

Weakness classes (CWE)

  • CWE-347Base

    Improper Verification of Cryptographic Signature

    The product does not verify, or incorrectly verifies, the cryptographic signature for data.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-05 14:57 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:xml::sig_project:xml::sig:*:*:*:*:*:perl:*:* versions up to (excluding) 0.71
    • Reference Type: CPANSec: https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch Types: Patch
    • Reference Type: CPANSec: https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes Types: Release Notes
  2. New CVE Received2026-08-03 14:16 UTC· 9b29abf9-4ab0-4765-b253-1875cd9b441e
    • Affected: XML::Sig
    • Description: XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
    • CWE: CWE-347
    • Reference: https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch

Linked advisories