Common Weakness Enumeration
CWE-347
Weakness AllowedImproper Verification of Cryptographic Signature
Abstraction: Base · Status: Draft
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Architecture and Design
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Contribution: "Mapping CWE to 62443" Sub-Working Group
· CWE-CAPEC ICS/OT SIG
· 2023-04-25
· CWE 4.11
Suggested mappings to ISA/IEC 62443.
Contribution: Abhi Balakrishnan
· 2024-09-10
· CWE 4.16
Provided diagram to improve CWE usability
Modification: Sean Eidemiller
· Cigital
· 2008-07-01
· CWE 1.0
added/updated demonstrative examples
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Description, Name
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Common_Consequences, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Demonstrative_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-01-19
· CWE 2.10
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Modes_of_Introduction, Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Diagram
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Relationships, Weakness_Ordinalities
1562 vulnerabilities reference this CWE, most recent first.
CVE-2026-121970 (GCVE-0-2026-121970)
Vulnerability from cvelistv5 – Published: 2026-11-04 13:01 – Updated: 2026-11-04 18:47 X_Open Source
VLAI
EPSS
VEX
Title
Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery
Summary
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:46 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/woo-vipps/#developers | patchrelease-notes |
| https://plugins.trac.wordpress.org/browser/woo-vi… | |
| https://plugins.trac.wordpress.org/browser/woo-vi… | |
| https://www.vulncheck.com/advisories/pay-with-vip… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wphostingdev | Pay with Vipps and MobilePay for WooCommerce |
Affected:
5.0.0 , < 6.4.1
(semver)
cpe:2.3:a:wphostingdev:pay_with_vipps_and_mobilepay_for_woocommerce:*:*:*:*:*:*:*:* |
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121970",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:46:57.425233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:47:15.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pay with Vipps and MobilePay for WooCommerce",
"vendor": "wphostingdev",
"versions": [
{
"lessThan": "6.4.1",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wphostingdev:pay_with_vipps_and_mobilepay_for_woocommerce:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "buiih"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim\u0027s active WooCommerce subscription."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T13:01:41.868Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Patch",
"tags": [
"patch",
"release-notes"
],
"url": "https://wordpress.org/plugins/woo-vipps/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/changelog.txt"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/includes/wc-vipps-recurring.php"
},
{
"name": "VulnCheck Advisory: Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery"
}
],
"tags": [
"x_open-source"
],
"title": "Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121970",
"datePublished": "2026-11-04T13:01:41.868Z",
"dateReserved": "2026-11-04T12:58:32.302Z",
"dateUpdated": "2026-11-04T18:47:15.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121606 (GCVE-0-2026-121606)
Vulnerability from cvelistv5 – Published: 2026-11-04 01:00 – Updated: 2026-11-04 01:00
VLAI
EPSS
VEX
Title
Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
Summary
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430443 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430443/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121606 | third-party-advisory |
| https://vuldb.com/submit/1023261 | third-party-advisory |
| https://gist.github.com/gajgdm6-cpu/cf98af20ddb77… | exploit |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Qihoo 360 | D621-2 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d621-2:*:*:*:*:*:*:*:* |
|
| Qihoo 360 | D603-2 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d603-2:*:*:*:*:*:*:*:* |
|
| Qihoo 360 | D600-2 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d600-2:*:*:*:*:*:*:*:* |
|
| Qihoo 360 | D619 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d619:*:*:*:*:*:*:*:* |
|
| Qihoo 360 | D606-6 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d606-6:*:*:*:*:*:*:*:* |
|
| Qihoo 360 | D706 |
Affected:
6.4.0
Affected: 6.4.1 Affected: 6.4.2 Affected: 6.4.3 Affected: 6.4.4 Affected: 6.4.5 Affected: 6.4.6 Affected: 6.4.7 Affected: 6.4.8 Affected: 6.4.9 cpe:2.3:a:qihoo_360:d706:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:qihoo_360:d621-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D621-2",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:qihoo_360:d603-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D603-2",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:qihoo_360:d600-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D600-2",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:qihoo_360:d619:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D619",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:qihoo_360:d606-6:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D606-6",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:qihoo_360:d706:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"product": "D706",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.4.4"
},
{
"status": "affected",
"version": "6.4.5"
},
{
"status": "affected",
"version": "6.4.6"
},
{
"status": "affected",
"version": "6.4.7"
},
{
"status": "affected",
"version": "6.4.8"
},
{
"status": "affected",
"version": "6.4.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaomao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:00:26.282Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430443 | Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430443"
},
{
"name": "VDB-430443 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430443/cti"
},
{
"name": "CVE-2026-121606 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121606"
},
{
"name": "Submit #1023261 | 360 (Qihoo 360) 360 Smart Camera (IPC) 6.0.24 ~ 6.4.9 Improper Verification of Cryptographic Signature",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1023261"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:28:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121606",
"datePublished": "2026-11-04T01:00:26.282Z",
"dateReserved": "2026-11-03T16:23:40.412Z",
"dateUpdated": "2026-11-04T01:00:26.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120459 (GCVE-0-2026-120459)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 14:29
VLAI
EPSS
VEX
Title
python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key
Summary
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
Severity
7.4 (High)
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mpdavis/python-jose/issues/398 | issue-tracking |
| https://github.com/mpdavis/python-jose/blob/3.5.0… | technical-description |
| https://github.com/mpdavis/python-jose/blob/3.5.0… | technical-description |
| https://www.vulncheck.com/advisories/python-jose-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mpdavis | python-jose |
Affected:
0 , ≤ 3.5.0
(semver)
cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:* |
Date Public
2026-03-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/python-jose",
"product": "python-jose",
"repo": "https://github.com/mpdavis/python-jose",
"vendor": "mpdavis",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gavin Blacklock"
},
{
"lang": "en",
"type": "finder",
"value": "Conner Webber"
}
],
"datePublic": "2026-03-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application\u0027s HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:15.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/mpdavis/python-jose/issues/398"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py"
},
{
"name": "VulnCheck Advisory: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key"
}
],
"title": "python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120459",
"datePublished": "2026-11-02T14:29:15.767Z",
"dateReserved": "2026-11-02T12:42:23.406Z",
"dateUpdated": "2026-11-02T14:29:15.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119561 (GCVE-0-2026-119561)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 16:21
VLAI
EPSS
VEX
Title
phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
Summary
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:21 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/phpmyadmin/phpmyadmin/blob/REL… | technical-description |
| https://abraxaslabs.tech/research/PMA-5.2.3-WebAu… | third-party-advisory |
| https://abraxaslabs.tech/research/phpmyadmin-webauthn | third-party-advisory |
| https://github.com/phpmyadmin/phpmyadmin | product |
| https://www.vulncheck.com/advisories/phpmyadmin-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phpMyAdmin | phpMyAdmin |
Affected:
0 , ≤ 5.2.3
(semver)
cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:* |
Date Public
2026-09-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:21:10.400395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:21:29.456Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/phpmyadmin/phpmyadmin",
"product": "phpMyAdmin",
"repo": "https://github.com/phpmyadmin/phpmyadmin",
"vendor": "phpMyAdmin",
"versions": [
{
"lessThanOrEqual": "5.2.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim\u0027s MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:09.654Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/phpmyadmin-webauthn"
},
{
"tags": [
"product"
],
"url": "https://github.com/phpmyadmin/phpmyadmin"
},
{
"name": "VulnCheck Advisory: phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authentication-bypass-via-customserver"
}
],
"title": "phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119561",
"datePublished": "2026-10-30T11:31:09.654Z",
"dateReserved": "2026-10-30T10:53:30.067Z",
"dateUpdated": "2026-10-30T16:21:29.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119037 (GCVE-0-2026-119037)
Vulnerability from cvelistv5 – Published: 2026-10-30 12:56 – Updated: 2026-10-30 12:56
VLAI
EPSS
VEX
Title
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
Summary
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.
signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.
A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Severity
No CVSS data available.
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://metacpan.org/release/LEEJO/Business-GoCar… | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Business::GoCardless"
],
"packageName": "Business-GoCardless",
"packageURL": "pkg:cpan/Business-GoCardless",
"programFiles": [
"lib/Business/GoCardless/Utils.pm"
],
"programRoutines": [
{
"name": "Business::GoCardless::Utils::signature_valid"
}
],
"repo": "https://github.com/payprop/business-gocardless",
"versions": [
{
"lessThan": "1.01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.\n\nsignature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is.\n\nA remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:56:27.922Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Business-GoCardless 1.01 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-119037",
"datePublished": "2026-10-30T12:56:27.922Z",
"dateReserved": "2026-10-29T11:38:31.744Z",
"dateUpdated": "2026-10-30T12:56:27.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118774 (GCVE-0-2026-118774)
Vulnerability from cvelistv5 – Published: 2026-10-29 18:33 – Updated: 2026-11-03 16:17
VLAI
EPSS
VEX
Title
Forge: Certificate signature verified with the issuer's RSA signature scheme
Summary
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:07 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/digitalbazaar/forge/security/a… | x_refsource_CONFIRM |
| https://github.com/digitalbazaar/forge/commit/c7f… | x_refsource_MISC |
| https://github.com/digitalbazaar/forge/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| digitalbazaar | forge |
Affected:
< 1.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:07:42.750179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:17:21.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "forge",
"vendor": "digitalbazaar",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer\u0027s private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T18:33:46.399Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-9wg5-mj3p-v49q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-9wg5-mj3p-v49q"
},
{
"name": "https://github.com/digitalbazaar/forge/commit/c7f42614d5166a77ddf11ce174b2601b14f6956b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/commit/c7f42614d5166a77ddf11ce174b2601b14f6956b"
},
{
"name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
}
],
"source": {
"advisory": "GHSA-9wg5-mj3p-v49q",
"discovery": "UNKNOWN"
},
"title": "Forge: Certificate signature verified with the issuer\u0027s RSA signature scheme"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118774",
"datePublished": "2026-10-29T18:33:46.399Z",
"dateReserved": "2026-10-28T19:20:05.018Z",
"dateUpdated": "2026-11-03T16:17:21.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118768 (GCVE-0-2026-118768)
Vulnerability from cvelistv5 – Published: 2026-10-29 17:20 – Updated: 2026-11-03 16:06
VLAI
EPSS
VEX
Title
Botan: CLI utility `ocsp_check` accepts unauthenticated responses
Summary
Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:06 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/randombit/botan/security/advis… | x_refsource_CONFIRM |
| https://github.com/randombit/botan/pull/5825 | x_refsource_MISC |
| https://github.com/randombit/botan/commit/46b2a9c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:06:39.020869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:06:50.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "botan",
"vendor": "randombit",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.11.34, \u003c 3.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate\u0027s Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:20:05.577Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw"
},
{
"name": "https://github.com/randombit/botan/pull/5825",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/randombit/botan/pull/5825"
},
{
"name": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983"
}
],
"source": {
"advisory": "GHSA-mpr7-9494-4qcw",
"discovery": "UNKNOWN"
},
"title": "Botan: CLI utility `ocsp_check` accepts unauthenticated responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118768",
"datePublished": "2026-10-29T17:20:05.577Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-11-03T16:06:50.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118559 (GCVE-0-2026-118559)
Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
VLAI
EPSS
VEX
Title
Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
Summary
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
Severity
No CVSS data available.
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Commerce Stripe |
Affected:
0.0.0 , < 1.4
(semver)
Affected: 2.0.0 , < 2.2.3 (semver) |
Date Public
2026-10-28 16:56
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/commerce_stripe",
"product": "Commerce Stripe",
"repo": "https://git.drupalcode.org/project/commerce_stripe",
"vendor": "Drupal",
"versions": [
{
"lessThan": "1.4",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "2.2.3",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Willows (hsjbrianwillows)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ryan Szrama (rszrama)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Tom Ashe (tomtech)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2026-10-28T16:56:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3."
}
],
"impacts": [
{
"capecId": "CAPEC-473",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-473 Signature Spoof"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:09:02.462Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-264"
}
],
"title": "Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-118559",
"datePublished": "2026-10-30T03:09:02.462Z",
"dateReserved": "2026-10-28T15:50:46.719Z",
"dateUpdated": "2026-10-30T03:09:02.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118040 (GCVE-0-2026-118040)
Vulnerability from cvelistv5 – Published: 2026-10-28 12:30 – Updated: 2026-10-28 12:30
VLAI
EPSS
VEX
Title
Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
Summary
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
Severity
7.5 (High)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.telerik.com/devtools/document-proces… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | Telerik Document Processing Libraries |
Affected:
0 , < 2026.3.1027
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Telerik Document Processing Libraries",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2026.3.1027",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.\u003c/p\u003e"
}
],
"value": "In Progress\u00ae Telerik\u00ae Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Signature Spoofing by Improper Validation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T12:30:41.623Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-improper-verification-of-cryptographic-signature-cve-2026-118040"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-118040",
"datePublished": "2026-10-28T12:30:41.623Z",
"dateReserved": "2026-10-27T15:05:17.645Z",
"dateUpdated": "2026-10-28T12:30:41.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117691 (GCVE-0-2026-117691)
Vulnerability from cvelistv5 – Published: 2026-11-05 13:27 – Updated: 2026-11-05 16:29
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
Summary
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:28 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-117691 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2561977 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-11-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117691",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:28:53.520705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:29:19.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Mayssen Aidoudi (Think-it GmbH) for reporting this issue."
}
],
"datePublic": "2026-11-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T13:27:23.748Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-117691"
},
{
"name": "RHBZ#2561977",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561977"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T20:13:03.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-117691",
"datePublished": "2026-11-05T13:27:23.748Z",
"dateReserved": "2026-10-27T13:49:55.445Z",
"dateUpdated": "2026-11-05T16:29:19.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.