This vulnerability affects the dol_verifyHash function in the htdocs/core/lib/security.lib.php file of Dolibarr ERP CRM's Online Signature Module. Improper verification of cryptographic signatures may allow an attacker to bypass signature validation remotely. Exploitation is complex and does not require privileges or user interaction. The vulnerability is present in versions 23.0.0 through 23.0.2. No vendor response or patch has been provided as of the publication date. The CVSS 4.0 base score is 6.3, reflecting medium severity with network attack vector and high attack complexity.

Successful exploitation could allow an attacker to bypass cryptographic signature verification, potentially undermining the integrity assurances of signed data within the affected module. This could lead to unauthorized acceptance of forged or tampered signatures. However, the attack complexity is high, and no privileges or user interaction are required. No known exploits in the wild have been reported, but public exploit code is available, increasing the risk of exploitation.

No official patch or remediation guidance is currently available from the vendor, as they have not responded to the disclosure. Users should monitor the vendor's channels for updates and consider implementing additional application-layer verification controls if possible. Given the public availability of exploit code, cautious use or temporary disabling of the affected Online Signature Module may be warranted until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.