From 26df8e9185c159f47a8c7e405a1a357043707eb0 Mon Sep 17 00:00:00 2001
From: John Hsu <john.hsu@ubc.ca>
Date: Wed, 5 Aug 2026 13:48:04 -0700
Subject: [PATCH] Net::SAML2 0.86 security fix now requires cacert

Net::SAML2 0.86 is a security release that fixes CVE-2026-18092, CVE-2026-18089.

CVE-2026-18089 fix requires adding the (previously optional) cacert param to the
Net::SAML2::Protocol::Assertion->new_from_xml call. This ensures that if there
are embedded certificates in the assertions, they are verified to be trusted by
the IdP before being used.
---
 lib/WeBWorK/Authen/Saml2.pm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/WeBWorK/Authen/Saml2.pm b/lib/WeBWorK/Authen/Saml2.pm
index 4719aa856d..6c77f65a0e 100644
--- a/lib/WeBWorK/Authen/Saml2.pm
+++ b/lib/WeBWorK/Authen/Saml2.pm
@@ -73,7 +73,8 @@ sub do_verify ($self) {
 			->handle_response($c->stash->{saml2}{samlResp});
 		my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(
 			xml      => $decodedXml,
-			key_file => $self->spKeyFile->to_string
+			key_file => $self->spKeyFile->to_string,
+			cacert   => $idpCertificateFile->to_string
 		);
 
 		# Get the database key containing the authReqId that was generated before redirecting to the identity provider.