DigiDoc CVE-2026-103902

Exploitation requires an attacker to construct a document with a forged XAdES signature and have it validated by an affected, unpatched DigiDoc component - libdigidocpp 4.0.0-before 4.5.0, DigiDoc4 4.6.0-before 4.11.0, or DigiDoc Android/iOS 2.7.0-before 3.1.0 - where XMLDocument::verifySignature performs signature checking without binding to the signing certificate's public key. No authentication is required (PR:N) and no special non-default feature toggle is needed, since the defective verification path is the standard validation routine. The principal limiting factor is that the victim/relying party must use an affected version to validate the forged document; patched versions (which pass the X509 certificate into verification and reject a missing cert) display the forgery as invalid.

This is a CWE-347 improper cryptographic signature verification flaw scored CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), a pure integrity impact (I:H, C:N, A:N) consistent with signature forgery rather than data theft. The source diff in vendor PR #735 confirms the root cause: XMLDocument::verifySignature() validated the XAdES signature without binding it to the signer's X509 certificate public key, so a signature could verify against an attacker-chosen key embedded in the document - the fix threads signingCertificate()/signingCert() into verification and rejects when no cert is present. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation status is 'no public exploit identified at time of analysis' and real-world exploitation is unproven. Despite the network vector and low complexity, practical risk is tempered because the payoff is forging legally-meaningful signatures on documents a relying party then validates with an affected version - high impact in the Estonian eID trust context, but not a mass-automatable internet-facing RCE. Treat as a high-priority patch for any workflow that legally relies on DigiDoc signature validation; de-prioritize relative to actively-exploited KEV items given the absence of exploitation signals.

An attacker crafts a document bearing a forged XAdES digital signature whose embedded key does not belong to the claimed signer. Because affected DigiDoc software verifies the signature without binding it to the signer's trusted certificate, the victim's client (or a backend validation service using libdigidocpp) displays the forged signature as valid, enabling repudiation or fraud on contracts and official documents. No public exploit was identified, but the patch diff (PR #735) clearly reveals the exploitable missing certificate binding.