The vulnerability CVE-2026-4599 in jsrsasign arises from incomplete comparison logic in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions within src/crypto-1.1.js. These incorrect compareTo checks accept out-of-range candidates, enabling an attacker to bias the Digital Signature Algorithm (DSA) nonces used during signature generation. Exploiting this flaw allows recovery of the private key, representing a critical cryptographic compromise. The issue is classified under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). According to Red Hat's advisory, no suitable mitigation or fix currently meets their standards for deployment and stability. The vulnerability affects jsrsasign versions from 7.0.0 through 11.1.1 inclusive.

Exploitation of this vulnerability allows an attacker to recover the private key by biasing DSA nonces during signature generation. This compromises the confidentiality and integrity of cryptographic operations relying on the affected jsrsasign versions. The CVSS v4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high confidentiality and integrity impact. Availability is not affected.

No official patch or mitigation meeting Red Hat's criteria for ease of use, applicability, and stability is currently available. Users are advised to monitor vendor advisories for updates. Consider upgrading to a version of jsrsasign that addresses this vulnerability once available. Until then, avoid using affected versions (7.0.0 through 11.1.1) in security-critical contexts.