What is the CVSS score of CVE-2026-23966?

CVE-2026-23966 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sm Crypto are affected by CVE-2026-23966?

Organizations using the SM2 decryption logic of sm-crypto face critical risk from CVE-2026-23966 rated CVSS 9.1.. A patch is available.

How to fix or mitigate CVE-2026-23966?

Within 24 hours: Identify all affected systems running the SM2 decryption logic of sm-crypto and apply vendor patches immediately. Vendor patch is available.

Sm Crypto CVE-2026-23966

CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-01-22 security-advisories@github.com

GHSA-pgx9-497m-6c4v

Authentication Bypass Sm Crypto

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 25, 2026 - 15:30 nvd

Patch available

CVE Published

Jan 22, 2026 - 03:15 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

501 npm packages depend on sm-crypto (315 direct, 192 indirect)

Ecosystem-wide dependent count for version 0.3.14.

DescriptionGitHub Advisory

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

AnalysisAI

The sm-crypto JavaScript library has a private key recovery vulnerability in its SM2 implementation, allowing attackers to extract secret keys from signatures.

Technical ContextAI

The sm-crypto library has a CWE-345 insufficient verification vulnerability in its SM2 (Chinese national cryptographic standard) implementation that allows attackers to recover private keys from observed signatures.