# CVE-2026-86304

> As of 2026-09-06, CVE-2026-86304 is a vulnerability, EPSS 0.1% (1.1th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-86304 as of 2026-09-06; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

**Last updated:** 2026-09-06

## What is CVE-2026-86304?

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.

The record classifies CVE-2026-86304 under weakness class [CWE-347](https://intel.threadlinqs.com/cwe/CWE-347). The identifier was first published 29 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 0.1% probability of exploitation in the next 30 days, higher than 1.1% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Published:** 2026-09-06

## Is CVE-2026-86304 being exploited?

It currently carries a trending score of 30 in the Threadlinqs vulnerability feed.

## Affected products and versions

No affected-product or package list has been recorded for CVE-2026-86304 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2026-86304

No vendor patch reference has been recorded for CVE-2026-86304 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-86304

No threat campaign in the Threadlinqs corpus currently references CVE-2026-86304, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

## Sources

Enriched from CVE.org, GitHub Security Advisories, NVD, FIRST EPSS. Last verified by Threadlinqs on 2026-09-07. This product uses the NVD API but is not endorsed or certified by the NVD.

**Vendor advisory and patch**

- [metacpan.org — release notes](https://metacpan.org/release/POLETTIX/MojoX-Authentication-0.006/source/Changes)

**Other references**

- [metacpan.org](https://metacpan.org/release/POLETTIX/MojoX-Authentication-0.004/source/lib/MojoX/Authentication/Model/SAML2.pm#L188)
- [cve.org — related](https://www.cve.org/CVERecord?id=CVE-2026-18089)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-86304
Full detection coverage and IOCs for threats exploiting CVE-2026-86304 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp