A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 involves improper verification of cryptographic signatures. The implementation incorrectly used the issuer certificate's RSA padding and RSASSA-PSS parameters instead of those from the child certificate being verified. This could allow acceptance of a signature scheme mismatch, bypassing policies that require a declared signature scheme. The issue does not allow certificate identity forgery since the signature must still be produced with the trusted issuer's private key. The vulnerability is fixed in version 1.4.1.
A vulnerability in the Botan C++ cryptography library's ocsp_check command allows improper verification of OCSP response signatures. Versions from 1.11.34 up to but not including 3.13.0 do not verify the signature or authorize the signer of OCSP responses, potentially allowing a malicious or on-path attacker to present a forged OCSP response indicating a revoked certificate is valid. This issue affects only the command-line interface and is fixed in version 3.13.0.
CVE-2026-88078 is a vulnerability in Microsoft Edge (Chromium-based) involving improper verification of cryptographic signatures. This flaw could allow an unauthorized attacker to perform spoofing attacks over a network. The issue affects versions from 1.0.0.0 up to but not including 156.0.4314.42. Microsoft has released an official fix in version 156.0.4314.42. The vulnerability has a medium severity rating with a CVSS score of 4.3. No known exploits are reported in the wild at this time.
CVE-2026-33923 is a high-severity vulnerability in Nozomi Networks Guardian affecting versions prior to 26.4.0. It involves improper verification of cryptographic signatures in the update installation process. An attacker with administrative privileges can supply a malicious update bundle that appears valid but executes an unsigned script with root privileges, potentially compromising sensitive data and system configuration.
CVE-2026-110985 is a critical vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER authentication with the default JWT validator configuration. If the sasl.oauthbearer.jwks.endpoint.url is not set and no custom verification key resolver is configured, the broker falls back to a validator that does not verify JWT signatures, algorithms, or issuers. This allows unauthenticated remote attackers to forge tokens with any principal, including superusers, gaining full cluster access. The issue affects specific Kafka versions prior to fixed releases. From Kafka 4.2.2, 4.3.1, and 4.4.0 onward, brokers fail to start if misconfigured, preventing insecure operation.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-87102 is a high-severity vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587. It involves improper verification of cryptographic signatures, specifically improper token validation, which can lead to sensitive information disclosure and manipulation.
CVE-2026-87103 is a high-severity vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587. It involves improper verification of cryptographic signatures, specifically improper token validation, which can lead to sensitive information disclosure and manipulation.
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-106078 is a vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102 that allows an unauthenticated attacker to bypass REST API authentication by using a forged federation token. This flaw enables the attacker to receive responses from REST API endpoints that do not invoke the backup service, potentially exposing sensitive information or functionality.
The TiendaCrypto para WooCommerce WordPress plugin versions 1.0.1 through 1.2.1 improperly verify the authenticity of payment webhook requests by validating signatures against an always-empty key. This flaw allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case. The vulnerability has a low severity score and does not impact confidentiality or availability.
The jose library versions from 1.0.0 up to but not including 1.11.13 improperly verify ECDSA JWS signatures by accepting signatures of non-canonical length. This signature malleability allows multiple distinct signature byte strings to verify as valid for the same token, defeating security controls that rely on signature uniqueness such as token revocation by hash, replay caches, and deduplication. However, it does not enable forging new payloads or impersonating the signer. A fix is available in version 1.11.13.
PraisonAI versions 4.6.56 through 4.6.58 contain an improper authentication vulnerability in the LinearBot component. The bot starts a public webhook listener without requiring the LINEAR_WEBHOOK_SECRET, allowing unauthenticated network callers to submit forged Linear-Event: AgentSession requests. This leads to unauthorized processing of these requests and potential misuse of the bot's capabilities. The issue is fixed in version 4.6.59.
CVE-2026-89317 is an improper input validation vulnerability in the Eclipse Foundation's Eclipse KeyPont GOSE component. The vulnerability arises because the GOSE library parses the JWS 'crit' header but does not enforce the requirement from RFC 7515 §4.1.11 to reject tokens with unrecognized critical extension parameters. As GOSE implements no header extensions, it should reject any token with a non-empty 'crit' header but fails to do so. This flaw affects versions from 0 up to 1.0.0-rc4 and is fixed in version 1.0.0-rc4.
Authlib versions from 1.3.1 up to but not including 1.9.0 contain a vulnerability in the OctKey.import_key() function where asymmetric-key markers are only checked at the first byte. Due to acceptance of leading whitespace, comments, or byte-order marks in PEM loaders, an attacker can exploit this to use public-key bytes as an HMAC secret, allowing forgery of HS256 tokens with arbitrary claims. This bypasses the previous remediation for CVE-2024-37568. The issue is fixed in version 1.9.0.
CVE-2026-84918 is a vulnerability in the Drupal Monobank payment API caused by improper verification of cryptographic signatures. This flaw allows an attacker to spoof signatures, potentially leading to unauthorized actions within the payment API. The issue affects versions from 0.0.0 up to but not including 1.0.3. A fix is available in version 1.0.3. The vulnerability has a low severity rating with a CVSS score of 3.7.
CVE-2026-87947 is a vulnerability in the Drupal SAML SSO - Service Provider module that involves improper verification of cryptographic signatures, allowing signature spoofing. This affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability has a medium severity with a CVSS score of 4.8. A fix is available in version 3.2.0.
Apache Pulsar's MultiRolesTokenAuthorizationProvider improperly authorizes clients based on unverified JSON Web Tokens (JWTs) when anonymousUserRole is set and fallback authentication is allowed. This flaw allows unauthenticated clients to present forged or unsigned tokens with arbitrary roles, potentially gaining super-user access to administrative functions without valid credentials. The issue affects HTTP and WebSocket APIs but not the Pulsar binary protocol. It impacts Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.
CVE-2026-10141 is a critical vulnerability in the boa firmware update functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). The flaw is due to improper verification of cryptographic signatures, allowing an attacker to upload and install arbitrary firmware by sending an authenticated HTTP request. This can lead to full compromise of the device.