What is the CVSS score of CVE-2026-4602?

CVE-2026-4602 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-4602?

Within 24 hours: Audit all applications and dependencies to identify jsrsasign usage across the organization and document version numbers; notify relevant development and security teams. Within 7 days: Implement compensating controls including signature validation logging, disable jsrsasign-dependent features if non-critical, and deploy WAF rules to detect exploitation attempts; prioritize migration planning to alternative cryptographic libraries. Within 30 days: Complete migration to jsrsasign version 11.1.1 or later (once released), or transition to alternative libraries with equivalent functionality; conduct penetration testing to verify signature validation integrity.

Jsrsasign CVE-2026-4602

Q: Which versions of Jsrsasign are affected by CVE-2026-4602?

The jsrsasign library vulnerability (CVE-2026-4602) enables attackers to forge or invalidate digital signatures without authentication, directly compromising the integrity of any application relying…. A patch is available.

EUVD-2026-14379 HIGH

Incorrect Conversion between Numeric Types (CWE-681)

2026-03-23 snyk

GHSA-8qwj-4jxw-m8jw

Information Disclosure N A Jsrsasign

7.7

CVSS 4.0 · Vendor: snyk

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft RSA signature with negative exponent
Delivery

Call modPow with negative value
Exploit

Trigger incorrect numeric type conversion
Execution

Compute wrong modular inverse
Impact

Bypass signature verification

Vulnerability Assessment

Weakness	CWE CWE-681 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Exploitation Conditions	jsrsasign versions before 11.1.1 with ext/jsbn2.js included. Remote unauthenticated attacker can exploit by calling modPow with negative exponent during signature verification, causing denial of service through incorrect modular inverse computation. No user interaction required.
Impact	The CVSS score of 7.5 (High) reflects network-based exploitation with low complexity requiring no privileges or user interaction, but the impact is rated only for availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). However, this scoring appears inconsistent with the actual vulnerability impact, which compromises signature verification integrity rather than availability. The presence of proof-of-concept code (indicated by /E:P in the vector and GitHub Gist reference) significantly elevates real-world risk, as attackers can readily implement this technique to forge signatures or bypass authentication mechanisms that rely on jsrsasign for cryptographic validation. While not currently in CISA KEV, the combination of public POC availability, low attack complexity, network accessibility, and the critical role of signature verification in authentication and authorization workflows makes this a high-priority issue for organizations using affected versions. The cryptographic nature means exploitation could be highly automatable once integrated into attack toolkits.
Exploit ScenarioDerived	An attacker identifies a web application using a vulnerable version of jsrsasign for JWT token validation. By crafting a malicious JWT token and exploiting the negative exponent handling flaw during the signature verification process, the attacker forces the library to compute an incorrect modular inverse, causing the signature verification to fail in a predictable or exploitable manner. This could allow the attacker to forge valid-appearing tokens, bypass authentication mechanisms, or escalate privileges within the application. The attack requires only network access to the vulnerable application and can be performed without authentication, as demonstrated in the proof-of-concept at https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

The jsrsasign JavaScript library before version 11.1.1 contains a vulnerability that allows attackers to break signature verification by exploiting incorrect handling of negative exponents in modular exponentiation operations. This affects all versions prior to 11.1.1 of the jsrsasign package, enabling remote attackers without authentication to compromise cryptographic signature validation. A proof-of-concept exploit exists as indicated by the CVSS exploitability metric and public GitHub references demonstrating the attack technique.

RemediationAI

Upgrade the jsrsasign package to version 11.1.1 or later, which contains the fix implemented in commit 5ea1c32bb2aa894b4bd29849839afe4f98728195 available at https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195. The patch was merged via pull request 650 at https://github.com/kjur/jsrsasign/pull/650. For npm-based projects, update the package.json dependency and run npm update or npm install to fetch the patched version. Until patching is complete, conduct thorough code review to identify any instances where external or untrusted input could influence the exponent parameter in modPow or related cryptographic operations, and implement input validation to reject negative exponent values. Additionally, consider implementing defense-in-depth measures such as cryptographic signature verification at multiple layers and enhanced logging of signature validation failures to detect potential exploitation attempts.

Affected VersionsENISA

jsrsasign 0 <11.1.1

Affected Packages

npm jsrsasign fix: 11.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The jsrsasign library is a widely-used JavaScript implementation of JSON Web Signature, JSON Web Token, JSON Web Key and other cryptographic standards for web applications. The vulnerability (CWE-681: Incorrect Conversion between Numeric Types) resides in the ext/jsbn2.js file where the modPow function incorrectly handles negative exponents during modular exponentiation operations. When a negative exponent is passed to modPow, the function computes incorrect modular inverses, which are critical operations in RSA and other public-key cryptographic algorithms. The affected product is identified as cpe:2.3:a:n/a:jsrsasign:*:*:*:*:*:*:*:* covering all versions prior to the fix.

Know when Jsrsasign gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (snyk) PRIMARY 7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Red Hat 7.5 HIGH

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Jun 22, 2026 - 03:22 NVD

7.5 (HIGH) 7.7 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 23, 2026 - 05:00 nvd

HIGH 7.5

DescriptionCVE.org

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

38 npm packages depend on jsrsasign (10 direct, 28 indirect)

Ecosystem-wide dependent count for version 11.1.1.

Executive ViewAI

Why It Matters

The jsrsasign library vulnerability (CVE-2026-4602) enables attackers to forge or invalidate digital signatures without authentication, directly compromising the integrity of any application relying on this library for cryptographic verification. Organizations using affected versions face immediate risk of authentication bypass, data tampering, and potential compliance violations if digital signatures are used for critical business processes.

Business Impact: High

Compensating Controls

Implement application-level signature validation logging and alerting; disable or restrict access to features dependent on jsrsasign signature verification if non-critical to operations; apply WAF rules targeting abnormal signature verification patterns or requests with malformed exponents; segment networks to limit exposure of signature verification services; consider temporary transition to alternative cryptographic libraries with equivalent functionality until patched version is released; implement strict input validation on all signature inputs and enforce certificate pinning where applicable.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Threat Intel

1 source

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.