CVE-2026-4602 is a high severity vulnerability in the jsrsasign library prior to version 11.1.1. The issue arises from incorrect handling of negative exponents in the ext/jsbn2.js file's modPow function, which leads to incorrect modular inverse calculations. An attacker can exploit this by supplying a negative exponent, causing signature verification to be bypassed. This vulnerability impacts the integrity of cryptographic operations relying on jsrsasign, including Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay. The Red Hat advisory confirms the vulnerability and states that no suitable mitigation or fix currently meets their criteria for deployment.

The vulnerability allows remote attackers to bypass signature verification by forcing incorrect modular inverse computations through negative exponents. This compromises the integrity of cryptographic signatures, potentially allowing unauthorized actions or data tampering in affected applications that rely on jsrsasign for signature verification.

Currently, there is no available fix or mitigation that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor vendor advisories for updates. Until a fix is released, affected systems remain vulnerable. Consider limiting exposure of affected components where possible.