SB2026102184 - Insufficient verification of data authenticity in XMLSecLibs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102184

SB2026102184 - Insufficient verification of data authenticity in XMLSecLibs

Published: October 21, 2026

Security Bulletin ID SB2026102184
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge XML signatures and compromise the confidentiality and integrity of accepted messages without possessing the corresponding private key.

The vulnerability exists due to insufficient verification of cryptographic key types in XMLSecurityKey::loadKey() when an application loads trusted public key or certificate material in an unrecognized representation into a key object created by XMLSecurityDSig::locateKey(). A remote attacker can submit an XML document specifying an HMAC signature method and compute its signature using those public bytes as the HMAC secret to bypass signature verification.


Remediation

Install update from vendor's website.

References