CVE-2026-45575 is a high-severity vulnerability in the oviva-ag epa4all-client Java client used in the Telematik Infrastruktur. Versions prior to 1.2.2 are affected by improper verification of cryptographic signatures (CWE-347). An attacker capable of performing a man-in-the-middle (MITM) attack on the TLS connection within the TI network can substitute a forged discovery document. This document redirects critical URIs to attacker-controlled endpoints, enabling capture of signed authentication material. The vulnerability is fixed in version 1.2.2.
LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0.
CVE-2024-36334 is a high-severity vulnerability in AMD Radeon RX 7000 Series Graphics Products involving improper verification of cryptographic signatures in the Radeon RGB tool. This flaw could allow a malicious file placed in the installation directory to execute with elevated privileges, potentially leading to arbitrary code execution. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild. Users should monitor AMD advisories for updates.
A vulnerability in the azureauthextension component of opentelemetry-collector-contrib versions 0.124.0 through 0.150.0 allows server-side authentication bypass. The extension improperly validates Azure access tokens by comparing them as strings without proper JWT validation and uses the client-supplied Host header to determine token scope. This flaw enables an attacker holding any valid Azure token for any scope the collector's identity can mint to authenticate to any OpenTelemetry receiver using azure_auth. Tokens remain valid for their full lifetime, typically several hours. The vulnerability has a high severity with a CVSS score of 8.1.
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.
The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.
The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.
CVE-2026-42501 is a high-severity vulnerability in the Go toolchain's cmd/go module handling that allows a malicious module proxy to bypass checksum database validation due to improper verification of cryptographic signatures. This flaw enables acceptance of empty or unrelated checksum responses as valid, potentially leading to execution of altered Go toolchain versions or modules when using untrusted GOPROXY or GOSUMDB configurations. No official patch or remediation is currently available. Users are advised to upgrade their Go toolchain once a fix is released and can detect potential compromise by regenerating and verifying go.sum files. No known exploits have been reported in the wild at this time.
Admidio versions prior to 5.0.9 contain a vulnerability in their SAML Identity Provider implementation where the validateSignature() method's return value is ignored. This flaw causes the smc_require_auth_signed configuration to be ineffective, allowing unsigned or invalidly signed SAML authentication and logout requests to be processed as if they were properly signed. The issue has been fixed in version 5.0.9.
CVE-2026-33467 is a medium severity vulnerability in Elastic Package Registry version 0.1.0 involving improper verification of cryptographic signatures (CWE-347). This flaw could allow an attacker who can intercept network traffic or influence the contents served by a self-hosted registry to substitute a tampered package without triggering an integrity check failure. There is no official patch or remediation level provided by the vendor at this time, and no known exploits in the wild have been reported. The vulnerability impacts the integrity of packages distributed via the affected registry version.
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
CVE-2026-6966 is a medium severity vulnerability in AWS tough prior to version 0.22.0. It involves improper verification of cryptographic signature uniqueness during delegated role validation, allowing remote authenticated users to bypass the TUF signature threshold by duplicating a valid signature. This causes the client to accept forged delegated role metadata. AWS has released tough-v0.22.0 and tuftool-v0.15.0 to address this issue.
CVE-2026-6911 is a critical vulnerability in AWS Ops Wheel caused by missing verification of JWT signatures. This flaw allows unauthenticated attackers to forge JWT tokens and gain administrative access, including reading, modifying, and deleting all application data across tenants and managing Cognito user accounts. The issue affects AWS Ops Wheel versions 0 up to but not including 163, including version 0. AWS has released a patch to remediate this vulnerability. Users should redeploy from the updated repository and patch any forked or derivative code accordingly.
A vulnerability in nimiq-transaction prior to version 1.3.0 allows improper verification of cryptographic signatures in the staking contract's UpdateValidator transactions. Specifically, the contract accepts transactions that set a new voting key without requiring the associated proof of knowledge, enabling a potential BLS rogue-key attack. This flaw could allow an attacker to forge a quorum-looking justification by producing only a single signature due to aggregated BLS signature verification. The vulnerability has a medium severity with a CVSS score of 6.8. Exploitation is considered low likelihood because the attacker would need knowledge of the next epoch validator set, which is chosen unpredictably. The issue is fixed in version 1.3.
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment status across the Redsys, Bizum, and Google Pay gateway flows. This makes it possible for unauthenticated attackers to forge payment callback data and mark pending orders as paid when they know a valid order key and order amount, potentially allowing checkout completion and product or service fulfillment without a successful payment.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.