Skip to main content

Network-AI CVE-2026-64623

| EUVDEUVD-2026-45938 HIGH
Improper Verification of Cryptographic Signature (CWE-347)
2026-07-20 disclosure@vulncheck.com GHSA-37v5-gpcx-w9fc
Information Disclosure Jwt Attack
8.8
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.6 HIGH

Unauthenticated network attack with trivial signature bypass gives AV:N/AC:L/PR:N/UI:N; forged privileged grants primarily undermine integrity (I:H) with limited confidentiality/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 20, 2026 - 15:33 EUVD
Analysis Generated
Jul 20, 2026 - 12:41 vuln.today
CVE Published
Jul 20, 2026 - 12:19 cve.org
HIGH 8.8

DescriptionCVE.org

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC.

AnalysisAI

Signature-verification bypass in Network-AI before 5.13.4 lets unauthenticated remote attackers forge APS delegation payloads and mint signed permission-grant tokens for privileged scopes, including SHELL_EXEC. The root cause is a default local verifier in APSAdapter that treats any non-empty string as a valid cryptographic signature, so no real key material or authentication is needed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach APS delegation endpoint over network
Delivery
Craft forged APS payload with SHELL_EXEC scope
Exploit
Attach arbitrary non-empty signature string
Execution
Default verifier accepts, token issued
Persist
Present signed grant token
Impact
Invoke privileged shell execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that Network-AI (before 5.13.4) is running with the default local verifier active in APSAdapter - the shipped default configuration - and that the attacker can reach the APS delegation endpoint over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are largely consistent and point to genuine priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker who can reach the Network-AI APS endpoint crafts a delegation payload requesting the SHELL_EXEC scope and attaches any arbitrary non-empty string as the signature. Because the default local verifier accepts it, the server returns a validly signed permission-grant token, which the attacker then presents to invoke privileged actions such as shell execution. …
Remediation Vendor-released patch: upgrade Network-AI to 5.13.4 or later, which corrects the APSAdapter signature verification behavior; this is the primary and recommended fix per GitHub Security Advisory GHSA-3jf7-33vc-hgf4 (https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4) and the VulnCheck advisory (https://www.vulncheck.com/advisories/network-ai-before-cryptographic-signature-verification-bypass). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Immediately inventory all Network-AI deployments and their versions; determine network exposure and restrict access to authorized networks only using firewall rules or network segmentation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jwt Attack

View all
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL POC
9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
CVE-2025-59718 CRITICAL
9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
CVE-2025-25291 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2025-25292 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2022-25898 CRITICAL POC
9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2024-42004 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
CVE-2024-41145 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
CVE-2024-41138 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-35929 CRITICAL POC
9.8 Aug 04

cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2022-31053 CRITICAL POC
9.8 Jun 13

Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all
CVE-2013-3900 MEDIUM
5.5
CVE-2026-48558 CRITICAL POC
9.5
CVE-2025-59718 CRITICAL
9.8
CVE-2025-47827 MEDIUM POC
4.6
CVE-2025-25291 CRITICAL POC
9.3
CVE-2025-25292 CRITICAL POC
9.3
CVE-2022-25898 CRITICAL POC
9.8
CVE-2024-42004 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-64623 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy