Which versions of Jwt Attack are affected by CVE-2026-4541?

CVE-2026-4541 is a low-severity vulnerability in janmojzis tinyssh (CVSS 2.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…. A patch is available.

Is there a public PoC exploit available for CVE-2026-4541?

Yes, a public proof-of-concept exploit is available for CVE-2026-4541. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4541?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Jwt Attack CVE-2026-4541

Q: What is the CVSS score of CVE-2026-4541?

CVE-2026-4541 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14291 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-22 VulDB

Jwt Attack Information Disclosure

1.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.0 (LOW) 1.1 (LOW)

CVSS changed

Apr 18, 2026 - 05:22 NVD

2.5 (LOW) 2.0 (LOW)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 09:00 euvd

EUVD-2026-14291

Analysis Generated

Mar 22, 2026 - 09:00 vuln.today

Patch released

Mar 22, 2026 - 09:00 nvd

Patch available

CVE Published

Mar 22, 2026 - 08:35 nvd

LOW 2.5

DescriptionCVE.org

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB.

AnalysisAI

A cryptographic signature verification flaw exists in tinyssh's Ed25519 signature handler (crypto_sign_ed25519_tinyssh.c) that allows improper validation of signatures, potentially enabling an attacker to forge or bypass signature checks. Affected versions of janmojzis tinyssh up to 20250501 are impacted, with the vulnerability requiring local execution and high attack complexity. A public exploit has been disclosed, and vendor patches are available in version 20260301.

Technical ContextAI

The vulnerability resides in the Ed25519 signature verification implementation within tinyssh, a lightweight SSH server implementation. According to CWE-347 (Improper Verification of Cryptographic Signature), the flaw involves inadequate validation logic in the crypto_sign_ed25519_tinyssh.c component that handles EdDSA (Edwards-curve Digital Signature Algorithm) signature verification. TinySSH uses Ed25519 as a core cryptographic primitive for SSH host key authentication and message authentication. The CPE (cpe:2.3:a:janmojzis:tinyssh:*:*:*:*:*:*:*:*) indicates all versions of the tinyssh product line are in scope until patching. The root cause appears to be improper cryptographic signature validation logic that could allow an attacker with local access to bypass signature verification checks intended to authenticate SSH operations.

RemediationAI

Upgrade tinyssh to version 20260301 or later from the official repository (https://github.com/janmojzis/tinyssh/releases/tag/20260301). The patch commit 9c87269607e0d7d20174df742accc49c042cff17 addresses the signature verification flaw in crypto_sign_ed25519_tinyssh.c. For systems unable to patch immediately, restrict SSH access to tinyssh-based servers to trusted local networks and implement additional SSH access controls via iptables or equivalent firewall rules to limit local authentication attack surface. Monitor systems for suspicious signature validation errors in SSH logs and consider running tinyssh in sandboxed or containerized environments with restrictive Linux capabilities to limit the impact of local privilege exploitation.