/ 
MojoX-Authentication-0.002
/ MojoX::Authentication::Model::Hash
Security Advisories (1)
CVE-2026-86304 (2026-09-06)

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.

NAME

MojoX::Authentication::Model::Hash

SYNOPSIS

use MojoX::Authentication::Model::Hash;

DESCRIPTION

This class is not supposed to be used directly but through MojoX::Authentication::Model instead.

This class composes role MojoX::Authentication::Model::Role::Local and inherits its methods.

INTERFACE

create

my $instance = MojoX::Authentication::Model::Hash->new(
   $config, %args);

Constructor.

Can receive the configuration either from a more "generic" $config hash as well as direct named arguments.

First a name is determined, either from $args{name} or hashy by default. Then $config is looked at for a corresponding value, which is either expected to be missing/undef or be a hash reference. In case a hash reference is found, its pairs override those on %args, with the only exception of the key name which is preserved if already present or set to the default otherwise.

If the db key is present, a new instance of the class is created and returned. Otherwise, the method returns undef.

Also accepts parameters name (from %args only see above) and crypt_passphrase, that can be either a Crypt::Passphrase instance or arguments to instantate one.

db

my $db_hash = $provider->db;

Accessor to the hash holding the accounts database. Take extreme care to fiddle directly with its value.

load_user

my $user = $provider->load_user($ignored, $uid);

Load the user by its userid, compatibly with Mojolicious::Plugin::Authentication's interface for loading users. The first parameter (which is supposed to be a controller instance) is ignored.

This class has no distiction between user identifiers and user names.

load_user_by_name

my $user = $provider->load_user_by_name($ignored, $name);

Alias for "load_user", this class has no distiction between user identifiers and user names.

name

my $name = $provider->name;

Name assigned to the provider (e.g. if you want to use different databases at the same time and hence want to instantiate this class multiple times).

save_user

$provider->save_user($user);    # OR
$provider->save_user($user, $is_secret_cleartext);

Save a user.

The input $user is supposed to be a hash reference with at least keys name (for the username/userid) and secret (for the secret). it <MAY> contain other key/value pairs, which will be copied.

The secret is supposed to be already hashed. It is possible to set the optional additional parameter $is_secret_cleartext to a true value to indicate that the hashing should be done by the function before saving the user.

ANYTHING ELSE (INCLUDING AUTHOR, COPYRIGHT AND LICENSE)

See documentation for MojoX::Authentication.