CVE-2026-103902: CWE-347 Improper verification of cryptographic signature in DigiDoc libdigidocpp

This vulnerability (CWE-347) in DigiDoc's libdigidocpp and associated DigiDoc applications results from improper verification of cryptographic signatures. An attacker can exploit this to create forged digital signatures that the affected software mistakenly accepts as valid. The affected versions are libdigidocpp >=4.0.0 <4.5.0, DigiDoc4 >=4.6.0 <4.11.0, DigiDoc Android >=2.7.0 <3.1.0, and DigiDoc iOS >=2.7.0 <3.1.0. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows attackers to create forged digital signatures that the affected DigiDoc software incorrectly validates as authentic. This undermines the integrity of digital signatures, potentially allowing unauthorized actions or acceptance of maliciously altered documents as legitimate. There is no reported confidentiality or availability impact. No known exploits are currently reported in the wild.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when relying on digital signatures validated by affected versions of DigiDoc software.