CVE-2026-18568

This vulnerability in XML::Sig stems from a fundamental semantic flaw: the verify() function returns success when every signature is skipped, rather than when cryptographic verification actually succeeded. The code counts signatures upfront but tracks nothing about which ones were validated. When all signatures fail to match the id_attr criterion (or any other filter), the loop completes via next statements and returns 1 — but zero cryptographic operations occurred. The core problem is conflating 'verified nothing because nothing matched the criteria' with 'verified nothing and found no problems.' A verify() function that returns true for a completely unchecked document violates fail-safe defaults. The id_attr parameter compounds this by creating an additional early-exit path that expands the attack surface — documents can now be constructed where all signatures are filtered out before any crypto runs. If you're defending systems using XML::Sig, you cannot trust the verify() return value alone. Audit your call sites to determine what downstream actions are authorized by a successful return. If your application treats verify() == true as permission to execute code, transfer funds, or grant access, you have a privilege escalation vector. The immediate mitigation is to check whether any signatures were actually processed before trusting the result. If the library doesn't expose this, you may need to wrap the verify call with preconditions — ensuring at least one signature exists that matches your criteria before calling verify, or treating a 'success but nothing validated' result as a failure. Consider whether your documents should contain multiple signatures as a belt-and-suspenders measure, though this depends on your threat model. This pattern — count-first loops with early exits returning success on empty validation sets — has appeared in signature libraries across ecosystems. The fix in XML::Sig should distinguish 'verified successfully' from 'completed without checking anything,' ideally by requiring the function to assert what it actually verified before returning success.

Reviewed through automated stages and approved by a human before publication.