CVE-2026-64623 describes an improper verification of cryptographic signatures in Jovancoding's Network-AI product prior to version 5.13.4. The vulnerability exists in the APSAdapter module, where the default local verifier does not correctly validate signatures and accepts any non-empty string as valid. This weakness enables unauthenticated attackers to craft forged APS delegation payloads with arbitrary scopes, effectively bypassing signature verification controls. As a result, attackers can obtain signed permission-grant tokens that allow access to sensitive resources, including the ability to execute shell commands (SHELL_EXEC). The CVSS 4.0 base score is 8.8, indicating a high severity vulnerability with network attack vector, no privileges required, no user interaction, and significant impact on integrity and availability.

The vulnerability allows unauthenticated remote attackers to bypass cryptographic signature verification and obtain signed tokens granting permissions to sensitive resources. This can lead to unauthorized execution of shell commands and potentially full system compromise or unauthorized access to critical functions within Network-AI. The impact on confidentiality is low, but integrity and availability impacts are high due to the ability to execute arbitrary commands and manipulate permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Jovancoding's advisories for updates. Until a fix is available, restrict access to Network-AI components and consider additional network-level controls to limit exposure. Avoid deploying vulnerable versions in untrusted environments.