PT-2026-43045 · Krajowa Izba Rozliczeniowa · Szafir Sdk

Michał Leszczyński · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-9058

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

Fix

Weakness Enumeration

CWE-637

CWE-393

Related Identifiers

CVE-2026-9058

Affected Products

Szafir Sdk

References · 2

• https://elektronicznypodpis.pl · Note
• https://cert.pl/posts/2026/05/CVE-2026-9058 · Note