Insufficient verification of data authenticity in XMLSecLibs - #VU156664
Published: October 21, 2026
Vulnerability identifier: #VU156664
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge XML signatures and compromise the confidentiality and integrity of accepted messages without possessing the corresponding private key.
The vulnerability exists due to insufficient verification of cryptographic key types in XMLSecurityKey::loadKey() when an application loads trusted public key or certificate material in an unrecognized representation into a key object created by XMLSecurityDSig::locateKey(). A remote attacker can submit an XML document specifying an HMAC signature method and compute its signature using those public bytes as the HMAC secret to bypass signature verification.
Affected software
XMLSecLibs
Remediation
Install security update from vendor's website.
XMLSecLibs - update to 4.0.1