CVE-2026-4602 is a high-severity vulnerability in the jsrsasign package affecting versions before 11.1.1. The issue arises from improper handling of negative exponents in the ext/jsbn2.js file, leading to incorrect conversion between numeric types. Specifically, an attacker can exploit this by calling the modPow function with a negative exponent, which forces the computation of incorrect modular inverses. This undermines the integrity of signature verification processes relying on this package. Multiple Red Hat advisories address this vulnerability, indicating that patches or updates are available through their errata channels.

The vulnerability allows an attacker to break signature verification by causing incorrect modular inverse calculations. This compromises cryptographic assurances provided by jsrsasign, potentially enabling forgery or bypass of signature-based authentication or integrity checks. The CVSS 4.0 score of 8.7 reflects a high impact with network attack vector, no privileges or user interaction required, and high attack complexity. There are no reports of exploitation in the wild at this time.

A fix is available in jsrsasign version 11.1.1 and later. Users should upgrade to version 11.1.1 or newer to remediate this vulnerability. Red Hat has issued security advisories and errata that include patches for affected products incorporating jsrsasign. Applying these official updates is the recommended remediation. Patch status is confirmed by vendor advisories linked from Red Hat. No additional mitigation steps are indicated beyond applying the official fixes.