What is the CVSS score of EUVD-2026-14291?

EUVD-2026-14291 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-14291?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14291. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14291?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Tinyssh EUVD-2026-14291

| CVE-2026-4541 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-22 VulDB

Information Disclosure Jwt Attack Tinyssh

1.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-347 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Signature verification
Impact	The CVSS 2.5 score with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C indicates low immediate severity but with published exploit code (E:P). The attack requires local access (AV:L), high complexity (AC:H), and low privileges (PR:L), which significantly constrains real-world exploitation. The integrity impact (I:L) is limited, and there is no confidentiality or availability impact. However, the published exploit status and presence in active repositories elevate concern. The vulnerability's nature—cryptographic signature bypass—carries inherent risk despite the CVSS floor, as signature forgery could lead to unauthorized SSH access in multi-user or containerized environments. For organizations running tinyssh on multi-tenant systems or embedded appliances, the local privilege boundary becomes a critical risk factor. The high attack complexity mitigates automated exploitation, making this a moderate priority for patching rather than an emergency response scenario.
Exploit ScenarioDerived	An attacker with local user access on a system running vulnerable tinyssh could craft a malicious Ed25519 signature that passes the flawed verification logic, potentially allowing the attacker to authenticate as a different user or impersonate the SSH host to other clients. A public proof-of-concept (available at https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116) demonstrates the feasibility of signature forgery. While the attack requires local code execution and high technical understanding of Ed25519 cryptography, the presence of public exploit code lowers the barrier for motivated threat actors in multi-user or embedded systems scenarios.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 22, 2026

A cryptographic signature verification flaw exists in tinyssh's Ed25519 signature handler (crypto_sign_ed25519_tinyssh.c) that allows improper validation of signatures, potentially enabling an attacker to forge or bypass signature checks. Affected versions of janmojzis tinyssh up to 20250501 are impacted, with the vulnerability requiring local execution and high attack complexity. A public exploit has been disclosed, and vendor patches are available in version 20260301.

RemediationAI

Upgrade tinyssh to version 20260301 or later from the official repository (https://github.com/janmojzis/tinyssh/releases/tag/20260301). The patch commit 9c87269607e0d7d20174df742accc49c042cff17 addresses the signature verification flaw in crypto_sign_ed25519_tinyssh.c. For systems unable to patch immediately, restrict SSH access to tinyssh-based servers to trusted local networks and implement additional SSH access controls via iptables or equivalent firewall rules to limit local authentication attack surface. Monitor systems for suspicious signature validation errors in SSH logs and consider running tinyssh in sandboxed or containerized environments with restrictive Linux capabilities to limit the impact of local privilege exploitation.

Affected VersionsENISA

tinyssh 20250501

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Ed25519 signature verification implementation within tinyssh, a lightweight SSH server implementation. According to CWE-347 (Improper Verification of Cryptographic Signature), the flaw involves inadequate validation logic in the crypto_sign_ed25519_tinyssh.c component that handles EdDSA (Edwards-curve Digital Signature Algorithm) signature verification. TinySSH uses Ed25519 as a core cryptographic primitive for SSH host key authentication and message authentication. The CPE (cpe:2.3:a:janmojzis:tinyssh:*:*:*:*:*:*:*:*) indicates all versions of the tinyssh product line are in scope until patching. The root cause appears to be improper cryptographic signature validation logic that could allow an attacker with local access to bypass signature verification checks intended to authenticate SSH operations.

Know when Tinyssh gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.0 (LOW) 1.1 (LOW)

CVSS changed

Apr 18, 2026 - 05:22 NVD

2.5 (LOW) 2.0 (LOW)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

Patch released

Mar 22, 2026 - 09:00 nvd

Patch available

CVE Published

Mar 22, 2026 - 08:35 nvd

LOW 2.5

DescriptionCVE.org

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Executive ViewAI

Why It Matters

CVE-2026-4541 is a low-severity vulnerability in janmojzis tinyssh (CVSS 2.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 100% exploitable

Exploit

POC

Public exploit code exists

Data Quality

9 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Defer

Exploitation

Poc

System Exposure· derived

Small

Automatable

Human Impact

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +6

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.