Which versions of Szafir Sdk are affected by CVE-2026-9058?

The KIR Szafir SDK signature verification bypass (CVE-2026-9058, CVSS 9.3) allows attackers to forge digital signatures and bypass authentication checks, enabling account takeover and user…. A patch is available.

How to fix or mitigate CVE-2026-9058?

No public exploit has been identified at time of analysis. Within 24 hours, inventory all systems running KIR Szafir SDK versions prior to 463 and assess exposure scope. By day 7, deploy version 463 or later to all affected systems using the vendor's published migration path. Complete functional testing of authentication workflows within 30 days to confirm signature validation is enforcing properly post-upgrade.

Szafir Sdk CVE-2026-9058

Q: What is the CVSS score of CVE-2026-9058?

CVE-2026-9058 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31679 CRITICAL

Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') (CWE-637)

2026-05-25 CERT-PL

GHSA-7hq7-5m7p-r2pp

Authentication Bypass Szafir Sdk Krajowa Izba Rozliczeniowa

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERT-PL) · only source for this CVE.

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:19 vuln.today

Patch available

May 26, 2026 - 14:16 EUVD

CVE Published

May 25, 2026 - 13:23 nvd

UNKNOWN (no severity yet)

CVE Published

May 25, 2026 - 13:23 cve.org

CRITICAL 9.3

DescriptionCVE.org

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

AnalysisAI

Signature verification bypass in Krajowa Izba Rozliczeniowa (KIR) Szafir SDK before version 463 causes the SDK to return a 'Positively verified' success result (Result/@code 0) even when the signer's certificate trust could not be established (certificateType 'nondetermined'). Consuming applications that rely on this result for authentication accept forged or untrusted-chain signatures as valid, enabling authentication bypass and user impersonation. There is no public exploit identified at time of analysis and EPSS probability is low (0.04%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.