What is the CVSS score of CVE-2026-3562?

CVE-2026-3562 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-3562?

CVE-2026-3562 presents moderate security risk, a signature bypass vulnerability rated CVSS 6.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-3562?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Jwt Attack CVE-2026-3562

EUVD-2026-12164 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-13 zdi

Authentication Bypass RCE Jwt Attack

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 14:37 vuln.today

cvss_changed

Severity Changed

Apr 27, 2026 - 14:37 NVD

MEDIUM HIGH

CVSS changed

Apr 27, 2026 - 14:37 NVD

6.3 (MEDIUM) 8.8 (HIGH)

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12164

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:37 nvd

MEDIUM 6.3

DescriptionCVE.org

Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.

AnalysisAI

CVE-2026-3562 is an authentication bypass vulnerability in Philips Hue Bridge's HAP (HomeKit Accessory Protocol) implementation, specifically within the ed25519_sign_open function that fails to properly verify Ed25519 cryptographic signatures. Network-adjacent attackers can exploit this flaw without authentication to execute arbitrary code on affected Hue Bridge installations. The CVSS score of 6.3 reflects moderate severity with local network access requirements, though the authentication bypass nature elevates real-world risk for smart home environments.

Technical ContextAI

The vulnerability exists in the HomeKit Accessory Protocol (HAP) implementation used by Philips Hue Bridge for secure device communication and authentication. The root cause is CWE-347: Improper Verification of Cryptographic Signature, specifically in the ed25519_sign_open function which handles Ed25519 elliptic curve signature validation. Ed25519 is a high-security elliptic curve signature scheme commonly used in HAP for device authentication and secure pairing. The improper verification allows attackers to forge or bypass signature checks, circumventing the cryptographic authentication mechanism designed to restrict access to privileged operations. Affected products are identified via CPE cpe:2.3:a:philips:hue_bridge:*:*:*:*:*:*:*:* indicating all Philips Hue Bridge versions are potentially vulnerable, though specific affected version ranges are not explicitly defined in available sources.