CVE-2026-14296 is a vulnerability in Nordic Semiconductor ASA's nRF54H20 affecting versions 3.2 and 3.3. It involves improper verification of cryptographic signatures when using the Direct XIP update strategy. The main application image may start other cores, such as the radio core, based on an unauthenticated slot address, leading to potential execution of unverified code. This flaw arises because MCUboot assumes the system is bootable if at least one slot per image exists, without ensuring all images are authenticated consistently.
CVE-2026-86304 is a critical vulnerability in MojoX::Authentication for Perl versions before 0.006 that allows bypassing SAML authentication. The flaw arises because the parse_assertion function does not properly verify cryptographic signatures on unencrypted assertions, allowing an attacker to authenticate arbitrary NameIDs by submitting a response signed with their own certificate.
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication.
This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable).
Releases 7.23.4 and 7.24.2 included an incomplete fix.
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
CVE-2026-80098 is a critical vulnerability in Microsoft Copilot Studio involving improper verification of cryptographic signatures. This flaw allows an unauthorized attacker to elevate privileges over a network, potentially compromising the integrity and confidentiality of the system. An official fix is available from Microsoft.
CVE-2026-80465 is a high-severity vulnerability in Siemens Mendix SAML modules for Mendix 9.24, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw involves improper verification of the SAML response signature, which could allow unauthenticated remote attackers to hijack user sessions in certain single sign-on (SSO) configurations. The issue affects all versions before the fixed releases 3.6.29 and 4.2.4. No known exploits are reported in the wild.
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting disables TLS certificate verification when KrakenD retrieves the JSON Web Key Set (JWKS) used to validate bearer tokens, potentially allowing an attacker with the ability to intercept this communication to provide a malicious JWKS and compromise token validation.
The issue has been addressed by making the parameter configurable through the boolean Helm value krakend.config.disableJwkSecurity and setting its default value to false, ensuring that TLS certificate verification is enabled by default.
CVE-2026-75759 is a high-severity vulnerability in erlef oidcc affecting versions from 3.2.0-beta.1 before 3.9.0. It involves improper verification of cryptographic signatures, allowing an unauthenticated attacker to impersonate arbitrary users by crafting encrypted ID tokens or JARM responses without nested signatures. The vulnerability arises because oidcc accepts unsigned encrypted tokens as valid, violating OpenID Connect Core 1.0 requirements that encrypted ID tokens must be signed then encrypted. UserInfo responses are not affected. No official patch or remediation level has been confirmed.
The WPMU DEV Dashboard WordPress plugin contains an authentication bypass vulnerability in all versions up to and including 5.0.1. This flaw arises from inconsistent HMAC message construction between two AJAX actions, allowing an attacker to replay a valid HMAC and gain administrator access on sites with Hub SSO enabled and mapped to an admin. The vulnerability has a critical severity with a CVSS score of 9.8.
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
CVE-2026-75946 is a high-severity vulnerability in HP Inc's OMEN Gaming Hub affecting versions prior to 1101.2608.0.0. It involves improper verification of cryptographic signatures, which could allow a local attacker to escalate privileges due to insufficient access controls. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a significant risk if exploited. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
Apache CloudStack versions 4.20.3.0 and 4.22.1.0 contain a vulnerability in SAML authentication where improper verification of cryptographic signatures allows a malicious actor to forge SAML responses. This can enable unauthorized login if the attacker spoofs the IdP IP address or registers a URL with the management server. Fixed versions 4.20.3.1 and 4.22.1.1 address this issue.
CVE-2026-62834 is a critical vulnerability in Microsoft Azure Data Factory involving improper verification of cryptographic signatures. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality and integrity. Microsoft has issued an official fix, and as this is a cloud service, remediation is managed by Microsoft. No known exploits are currently reported in the wild.
CVE-2026-19505 is a critical vulnerability in the RDK-B WebUI component of the RDK project. It involves improper verification of cryptographic signatures in the file jst_functions.c, allowing remote attackers to bypass authentication. By crafting a forged JWT with an invalid RSA signature, an attacker can gain administrative access to the system.
CVE-2026-76234 affects the celabshq cryptographic libraries libcrux-ecdh, libcrux-ed25519, and libcrux-psq prior to versions 0.0.6 and 0.0.7. The vulnerabilities include improper verification of cryptographic signatures due to incorrect handling of X25519 secret key length and clamping in libcrux-ecdh, duplicated clamping during key generation in libcrux-ed25519, and improper error handling in libcrux-psq. These issues were addressed in the respective patched releases.
Net::OAuth versions before 0.33 for Perl contain a critical vulnerability (CVE-2026-72889) where the signature verification algorithm is chosen by the sender, allowing an attacker to forge requests by exploiting improper verification of cryptographic signatures. The flaw arises because the signature_method parameter in incoming messages dictates the verification algorithm without pinning it on the verifier side. This enables attackers to use HMAC-SHA1 or HMAC-SHA256 with a guessable placeholder key, bypassing the intended RSA-SHA1 verification and allowing unauthorized request forgery.
CVE-2026-58085 is a vulnerability in the FreeBSD wg(4) driver where it fails to verify the success of the MAC (Poly1305) authentication tag during packet decryption. This flaw allows a remote attacker who can send UDP packets to a WireGuard endpoint and guess the receiver's replay window bounds to inject forged or modified transport data packets into the tunnel. Additionally, an attacker intercepting WireGuard packets can modify ciphertext and authenticated data without detection.
CVE-2026-55165 is a vulnerability in Netflix's lemur prior to version 1.9.2 involving improper verification of cryptographic signatures in JWT tokens. The JWT verifier reads the 'alg' header from an unverified token, allowing an attacker-controlled algorithm value to influence token decoding. Although PyJWT 2.x rejects 'alg=none' with the configured key, this flaw creates a defense-in-depth gap and weakens anomaly detection. The vulnerability could become exploitable after migrating to asymmetric signing due to algorithm confusion. The issue is fixed in lemur version 1.9.2 by introducing a server-controlled algorithm allowlist defaulting to HS256.
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs