CVE-2026-4600

Published: Mar 23, 2026Modified: Jul 20, 2026

8.1

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: report@snyk.io (Secondary)

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Affected (1)

Products: Kjur: Jsrsasign

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kjur Jsrsasign	Before 11.1.1

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (16)

https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7

Source: report@snyk.io

ExploitMitigationThird Party Advisory

https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60

Source: report@snyk.io

Patch

https://github.com/kjur/jsrsasign/pull/646

Source: report@snyk.io

Issue Tracking

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812268

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940

Source: report@snyk.io

Third Party Advisory

https://access.redhat.com/errata/RHSA-2026:19375

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:19409

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:19410

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:6568

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:6720

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:6912

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:6926

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/security/cve/CVE-2026-4600

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2450208

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4600.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.