CVE-2025-40934

CVE-2025-40934 is a critical vulnerability affecting XML-Sig versions 0.27 through 0.67 for Perl, where the module incorrectly validates XML files if signatures are omitted. An attacker can bypass signature verification by simply removing the signature from an XML document, leading to successful validation of an unsigned file that should otherwise return an error. Rated with a CVSS score of 9.3 (CRITICAL), this vulnerability has a low attack complexity and can lead to high integrity impact, allowing attackers to potentially inject malicious unsigned XML. While no active exploitation, public exploit code, or significant community discussion has been observed, the high FAUCET Risk Score of 91/100 indicates its severe potential.