CVE-2026-4600 describes an improper verification of cryptographic signatures in jsrsasign versions prior to 11.1.1. The vulnerability arises from insufficient validation of DSA domain parameters in the KJUR.crypto.DSA.setPublic function and related X.509 verification flows. An attacker can supply malicious domain parameters such as g=1, y=1, and r=1, which cause the verification equation to always evaluate as true regardless of the hash, enabling signature and certificate forgery. This can lead to unauthorized acceptance of forged signatures or certificates in applications relying on jsrsasign for cryptographic verification.

The vulnerability allows attackers to forge DSA signatures and X.509 certificates that pass verification, potentially leading to unauthorized access or data manipulation in affected systems. This compromises the integrity and authenticity guarantees provided by cryptographic signatures, impacting confidentiality and integrity of data. Red Hat products using jsrsasign, including Migration Toolkit for Virtualization and Red Hat Quay, are affected. There are no known exploits in the wild at this time.

According to the Red Hat advisory, no effective mitigation or patch currently meets their criteria for ease of use, applicability, or stability. Users should monitor vendor advisories for updates. Upgrading to jsrsasign version 11.1.1 or later, where this vulnerability is fixed, is recommended when feasible. For affected Red Hat products, consult Red Hat support or your Technical Account Manager for guidance. No temporary workaround is provided.