External risk intelligence

XML::Sig Signature Wrapping Vulnerability Allows SAML Assertion Tampering.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-9487

This vulnerability affects a Perl library used for XML signature verification, specifically noted in the context of SAML2 assertions. Libraries providing SAML2 authentication and signature processing are commonly integrated into internet-facing web applications, identity providers, and service providers to handle authentication, making the attack surface frequently exposed to the internet.

Xml\ \

before 0.71

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a weakness in how certain software verifies digital signatures in XML documents. It could allow an attacker to create a document that appears legitimate but contains manipulated information, potentially leading to unauthorized control over data within applications that rely on these signatures, such as for authentication.

Duplicate IDs undermine signature verification.
Impacts authentication and data integrity systems.
Confirm relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted XML document containing duplicate IDs to a system that uses a vulnerable version of the XML::Sig library for signature verification. The library would incorrectly validate the signature against the first element with a matching ID, while the application processing the document might later interpret a different element with the same ID. In a SAML2 context, this could allow an attacker to substitute their own content for a verified assertion.

Requires network access to the vulnerable service.
Triggered by verifying a malicious XML signature.
Risk of assertion content compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect applications using the affected Perl library for XML signature verification, particularly when processing SAML2 assertions. When an XML document contains duplicate IDs, the library may incorrectly verify a signature against one element while an application independently resolves the same ID to a different, attacker-controlled element. This could lead to the attacker controlling the content of a SAML2 Assertion.

Affected XML signature verification processes.
Duplicate IDs allow incorrect verification.
Attacker-controlled assertion content.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action will likely involve application owners, platform teams, and potentially security or vendor-management teams, depending on how the Perl XML::Sig library is integrated and managed. The immediate practical step is to locate all instances of the affected library, determine their exposure and criticality, identify the accountable teams or individuals, and then plan remediation activities like updates or configuration changes based on the assessed risk.

Identify system and application owners.
Verify SAML2 and XML signature usage.
Coordinate updates and risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XML::Sig and why is it used?

XML::Sig is a Perl library designed to handle digital signatures within XML documents. Developers use it to ensure the authenticity and integrity of data exchanged between systems. It is frequently employed in applications that require secure communication, such as SAML2-based authentication services, where it validates that the provided identity assertions have not been tampered with.

What does CVE-2026-9487 mean?

CVE-2026-9487 identifies a weakness known as Improper Verification of Cryptographic Signature (CWE-347). Because the library relies on an XPath expression that stops after finding the first matching ID, it fails to notice if duplicate IDs exist in a document. This flaw allows an attacker to bypass security checks by providing a document where the signature validates the first element, but the application processes a second, malicious element.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting an XML document featuring duplicate IDs to a service using an older version of XML::Sig. This does not occur if the XML document is perfectly formed with unique IDs throughout. The issue is specifically tied to the library's internal logic that accepts documents containing multiple elements with the same ID, misdirecting the verification process.

Is my application vulnerable?

Halo Surface Signal indicates that this vulnerability is often found in internet-facing web applications, identity providers, and service providers that process SAML2 assertions. If your system relies on this Perl library to verify XML signatures from untrusted network sources, you should consider it potentially exposed to this signature wrapping attack.

Do I need to update my software?

Yes. The first step is to perform an inventory of your environment to identify all applications or services utilizing XML::Sig versions prior to 0.71. Once these instances are located, coordinate with your development or platform teams to prioritize upgrading the library to the latest patched version to ensure duplicate ID validation is correctly handled.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.