PT-2026-27058 · Jsrsasign · Jsrsasign

Kr0Emer · CVE-2026-4602 · Published 2026-03-23 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description Incorrect Conversion between Numeric Types occurs due to the handling of negative exponents in the file ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling the modPow() function with a negative exponent.

Recommendations Update to version 11.1.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2026-4602

GHSA-8QWJ-4JXW-M8JW

Affected Products

Jsrsasign

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4602.json · Exploit
• 🔥 https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5 · Exploit
• https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195 · Patch
• https://osv.dev/vulnerability/CVE-2026-4602 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6720 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8qwj-4jxw-m8jw · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19409 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6568 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19410 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6926 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:19375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4602 · Security Note
• https://access.redhat.com/errata/RHSA-2026:6912 · Vendor Advisory
• https://github.com/kjur/jsrsasign · Note
• https://github.com/kjur/jsrsasign/pull/650 · Note