External risk intelligence

MojoX Authentication SAML Bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-86304

This vulnerability exists in a SAML authentication module. SAML is a standard protocol for identity federation and single sign-on, typically implemented at the internet-facing edge of web applications to handle external authentication requests. As a pre-authentication mechanism, it is by design exposed to the public internet to facilitate user login.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in a SAML authentication module, potentially allowing bypass of security checks. The issue arises from how the system validates signed authentication assertions. The primary concern is confirming if this specific authentication technology is in use within our environment to understand potential exposure.

Bypasses authentication in specific software.
Affects identity federation and single sign-on.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by crafting a SAML response with their own certificate. This allows them to impersonate any user and gain unauthorized access to the application.

Publicly accessible SAML endpoint required.
Attacker posts a forged SAML assertion.
Unauthenticated access to any user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass SAML authentication mechanisms when processing SAML assertions. When supported by the advisory, this could lead to unauthorized access to systems or services by presenting a forged assertion signed with an attacker's own certificate, potentially affecting any data or functionality protected by the affected authentication flow.

Authentication bypass.
Forged SAML assertions.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this SAML authentication bypass likely falls to platform or application teams responsible for identity and access management, with initial triage by network or security teams. The critical first step is to identify all instances of the affected module, confirm their exposure and business impact, and locate the accountable application owner to prioritize remediation efforts.

Platform/Application teams own the issue.
Verify external SAML authentication exposure.
Plan remediation based on business criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MojoX::Authentication?

MojoX::Authentication is a Perl-based software module used to handle user authentication within web applications. It is frequently employed to integrate Single Sign-On (SSO) capabilities, allowing developers to manage how users verify their identity when accessing web services. In this context, it specifically provides tools to process SAML, a widely used protocol for exchanging identity information between an identity provider and a service.

Why does CVE-2026-86304 allow an authentication bypass?

This vulnerability falls under CWE-347, which relates to the improper verification of cryptographic signatures. Because the software fails to properly anchor trust when parsing SAML assertions, it does not verify that a signature comes from a legitimate source. Instead of checking against a trusted certificate, the system can be tricked into accepting a response signed with an attacker's own certificate, allowing them to forge authentication data and impersonate any user.

How does an attacker trigger this vulnerability?

An attacker triggers this by initiating a SAML login process and then submitting a maliciously crafted SAML response to the application. The system accepts this forged assertion because it lacks the necessary trust anchor validation. Note that this bug is not triggered by standard, legitimate user traffic; it requires the specific submission of an improperly signed assertion that bypasses the intended security checks.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because this vulnerability exists within a SAML module. SAML is typically implemented at the internet-facing edge of web applications to enable federated login, meaning it is often intentionally exposed to the public internet. If your application uses this module for externally facing authentication, it is likely reachable by an attacker.

What should I do if I use this Perl module?

The immediate priority is to identify all applications or services in your environment that utilize MojoX::Authentication. Once identified, consult your application or platform teams to determine if they are using an affected version. If they are, coordinate with those teams to prioritize updating the software to a patched version, ensuring that the authentication flow is no longer susceptible to forged SAML assertions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.