SJCL CVE-2026-4258

The target application must (1) be using SJCL prior to 1.0.9, (2) invoke sjcl.ecc.basicKey.publicKey() on attacker-controlled (x,y) coordinates - typically a server-side ECDH key-agreement, JWE decryption, or signature-verification flow that ingests a peer public key from the network, and (3) expose an observable signal of the resulting ECDH shared secret (e.g. dhJavaEc()'s raw x-coordinate is returned, used as a symmetric key whose ciphertext is observable, or echoed in a JWT/JWE error message). The 'Jwt Attack' tag indicates JOSE/JWE consumers that accept attacker-chosen ephemeral keys are a primary attack surface. Limiting factors: SJCL deployments that use only symmetric crypto (AES, SHA, HMAC) are not exposed; client-only SJCL usage where the user's private key never processes attacker-supplied peer keys is not exposed; exploitation requires hundreds to thousands of oracle queries against the same victim private key, so short-lived ephemeral keys (true ECDHE with fresh keys per session) substantially reduce feasibility; the victim must reuse a long-term ECDH private key across queries for full recovery.

Signals are mixed and require careful interpretation. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H scores 7.7 and reflects unauthenticated network-reachable confidentiality loss with no integrity or availability impact - accurate for a private-key oracle. The E:P (Proof-of-Concept) threat metric aligns with the public Kr0emer gist, so publicly available exploit code exists. EPSS is very low (0.02%, 5th percentile) and the CVE is not on CISA KEV, indicating no observed mass exploitation; this fits the profile of a niche cryptographic flaw requiring a specific deployment (a server-side SJCL endpoint that performs ECDH against attacker-supplied public keys and reveals or uses the shared secret in an observable way). Real-world priority is moderate-to-high for any service still using SJCL for ECDH key exchange - full key compromise is catastrophic where it applies - but low for the many SJCL deployments that only use symmetric primitives. Note: the CVSS AV:N/PR:N rating assumes a typical server-side ECDH oracle pattern; purely client-side SJCL use does not match the attack model, so blanket application of the 7.7 score may overstate risk for some integrations.

A web or API service uses SJCL server-side to perform ECDH against a client-supplied public key - for example to derive a session key, decrypt a JWE, or implement an end-to-end-encrypted messaging handshake - and either returns the derived value or uses it in a way the attacker can observe. The attacker submits a sequence of crafted off-curve points lying in small subgroups, each ECDH response leaks the victim's private key modulo a small prime, and after a few hundred queries the attacker reconstructs the full private scalar via CRT and can impersonate the victim or decrypt past traffic. A public PoC by Kr0emer is available as a GitHub gist, lowering the engineering effort required.