The vulnerability in goxmldsig prior to version 1.6.0 arises from a loop variable capture issue in the validateSignature function within validate.go. Specifically, the code takes the address of the loop variable _ref instead of its value when iterating over references in the SignedInfo block. This causes the reference pointer to always point to the last element in the SignedInfo.References slice after the loop completes, which can lead to improper verification of XML digital signatures. This issue affects Go versions before 1.22 or when go.mod uses an older version. The vulnerability is identified as CWE-347 (Improper Verification of Cryptographic Signature) and CWE-682 (Incorrect Calculation). A patch fixing this issue is included in goxmldsig version 1.6.0.

The vulnerability allows an attacker to potentially bypass proper cryptographic signature verification by exploiting the incorrect handling of references in the SignedInfo block. This can lead to acceptance of forged or tampered XML signatures, undermining the integrity and authenticity guarantees provided by XML Digital Signatures. The CVSS 3.1 base score is 7.5 (High), indicating a significant impact on integrity without requiring privileges or user interaction.

A fixed version of goxmldsig is available as version 1.6.0, which addresses the loop variable capture issue in the validateSignature function. Users and organizations should upgrade to goxmldsig version 1.6.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigations are indicated by the vendor advisories.