PT-2026-27056 · Jsrsasign · Jsrsasign

Kr0Emer · Published 2026-03-23 · Updated 2026-03-28 · CVE-2026-4600

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description The software is susceptible to an issue involving improper verification of cryptographic signatures. This occurs due to inadequate validation of domain parameters within the DSA (Digital Signature Algorithm) implementation, specifically in the KJUR.crypto.DSA.setPublic function and related X509 verification processes in src/dsa-2.0.js. An attacker can exploit this by providing malicious domain parameters, such as setting g and y to 1 and r to 1, which allows the forging of DSA signatures or X.509 certificates that the X509.verifySignature() function will incorrectly accept.

Recommendations Update jsrsasign to version 11.1.1 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-4600

GHSA-WVQX-V3F6-W8RH

Affected Products

Jsrsasign

References · 12

• 🔥 https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7 · Exploit
• https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60 · Patch
• https://osv.dev/vulnerability/GHSA-wvqx-v3f6-w8rh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4600 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4600 · Vendor Advisory
• https://github.com/kjur/jsrsasign · Note
• https://github.com/kjur/jsrsasign/pull/646 · Note
• https://twitter.com/0dayPublishing/status/2036113222307102993 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940 · Note
• https://twitter.com/CVEnew/status/2035992480596804088 · Twitter Post
• https://twitter.com/zench4n/status/2037912349974339677 · Twitter Post
• https://twitter.com/CVEarity/status/2036121015303152015 · Twitter Post