CVE-2026-64623 describes an improper cryptographic signature verification vulnerability in Jovancoding's Network-AI product prior to version 5.13.4. The vulnerability exists in the APSAdapter module, where the default local verifier incorrectly accepts any non-empty string as a valid signature. This allows unauthenticated attackers to submit forged APS delegation payloads with arbitrary scopes, effectively bypassing signature verification. As a result, attackers can obtain signed permission-grant tokens that grant access to sensitive resources such as SHELL_EXEC, potentially leading to unauthorized command execution.

The vulnerability allows unauthenticated attackers to bypass cryptographic signature verification and obtain signed tokens granting permissions to sensitive resources, including shell execution capabilities. This can lead to unauthorized access and control over the affected system, posing a high security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the APSAdapter component and monitor for suspicious activity related to delegation payloads.