Signature verification bypass in Network-AI APSAdapter (CVE-2026-64623)

APSAdapter in the network-ai npm package initialises with a `local` verification mode by default. When no custom `verifySignature` callback is supplied, the built-in fallback verifier accepts any non-empty string as a valid cryptographic signature. An unauthenticated network attacker can submit a forged APS delegation payload with an arbitrary scope, bypass signature verification entirely, and obtain a signed permission-grant token for sensitive resources including SHELL_EXEC. Affected versions: - <= 5.13.3 We recommend updating to: 5.13.4. CVSS 8.8 · our assessment: this_week Reference: https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4 Details: https://vuln.today/cve/CVE-2026-64623