EUVD-2026-31679
GHSA-7hq7-5m7p-r2pp
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Signature verification bypass in Krajowa Izba Rozliczeniowa (KIR) Szafir SDK before version 463 causes the SDK to return a 'Positively verified' success result (Result/@code 0) even when the signer's certificate trust could not be established (certificateType 'nondetermined'). Consuming applications that rely on this result for authentication accept forged or untrusted-chain signatures as valid, enabling authentication bypass and user impersonation. There is no public exploit identified at time of analysis and EPSS probability is low (0.04%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Szafir Sdk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (CERT-PL) · only source for this CVE.
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.
This issue was fixed in version 463.
Executive ViewAI
The KIR Szafir SDK signature verification bypass (CVE-2026-9058, CVSS 9.3) allows attackers to forge digital signatures and bypass authentication checks, enabling account takeover and user impersonation. Any organization relying on this SDK for authentication or digital signature verification faces immediate risk of unauthorized access.
No public exploit has been identified at time of analysis. Within 24 hours, inventory all systems running KIR Szafir SDK versions prior to 463 and assess exposure scope. By day 7, deploy version 463 or later to all affected systems using the vendor's published migration path. Complete functional testing of authentication workflows within 30 days to confirm signature validation is enforcing properly post-upgrade.
Apply vendor patch: KIR Szafir SDK version 463 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB