EUVD-2026-21291
GHSA-47qf-hp3h-rwmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft ECCSI signature with invalid r, s scalars
-
ExploitSubmit forged signature to wolfSSL verifier
-
ExecutionBypass scalar range validation
-
ImpactAchieve signature verification for arbitrary message-identity pair
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Requires wolfSSL library with ECCSI signature verification enabled. Attacker with adjacent network access (AV:A) can forge signatures that verify against any message for any identity using publicly-known constants. No authentication or user interaction needed. Affects systems using ECCSI for identity-based cryptography. |
| Impact | CVSS 7.6 reflects high confidentiality and integrity impact via adjacent-network access with prior setup (AT:P). EPSS data unavailable; however, signature verification bypass enabling forged authentication across any identity without valid cryptographic material represents severe cryptographic failure. Organizations deploying ECCSI-dependent JWT or authentication schemes face complete compromise of message authenticity guarantees. |
| Exploit ScenarioDerived | Attacker obtains public ECCSI parameters and crafts signature with r, s values outside valid range [1, q-1]. Sends forged signature with arbitrary identity to verification endpoint. Unauthenticated verify function accepts crafted values; no exploit code confirmed public at analysis time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Signature verification bypass in wolfSSL's ECCSI implementation allows adjacent network attackers to forge cryptographic signatures for any message and identity without authentication. The wc_VerifyEccsiHash function fails to validate that signature scalars r and s fall within the required mathematical range [1, q-1], enabling attackers with knowledge of public constants to craft universally-valid forged signatures. This defeats the cryptographic integrity guarantees of ECCSI-signed data, particularly affecting JWT authentication systems and identity-based cryptographic protocols. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: wolfSSL 5.9.1. Immediately upgrade to version 5.9.1 or later, which implements mandatory range validation for ECCSI signature scalars. Upstream fix available at https://github.com/wolfssl/wolfssl/pull/10102. Organizations unable to upgrade immediately must disable ECCSI signature verification functionality in wolfSSL configurations and migrate ECCSI-dependent authentication flows (particularly JWT with ECCSI algorithms) to alternative cryptographic schemes such as ECDSA or RSA-PSS until patching is completed. Verify that no production systems accept ECCSI-signed tokens or messages during the interim period. Review application logs for anomalous authentication patterns that may indicate exploitation attempts prior to remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is missing input validation in mp_read_unsigned_bin calls when decoding signature scalars. CWE-347 (improper signature verification) stems from absent modular arithmetic boundary checks against elliptic curve order q. Attackers exploit this by constructing signature blobs with out-of-range scalar values that satisfy verification equations using only public domain parameters, bypassing the discrete logarithm problem that normally secures ECDSA-family schemes.
Know when Wolfssl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
wolfSSL's ECCSI signature verifier wc_VerifyEccsiHash decodes the r and s scalars from the signature blob via mp_read_unsigned_bin with no check that they lie in [1, q-1]. A crafted forged signature could verify against any message for any identity, using only publicly-known constants.
Executive ViewAI
wolfSSL's ECCSI signature verification contains a bypass allowing unauthenticated attackers on adjacent networks to forge cryptographic signatures for any message and identity, compromising the integrity of JWT authentication and identity-based protocols that depend on this library. Organizations using wolfSSL for ECCSI-based identity verification or JWT validation face immediate risk of authentication bypass and unauthorized access.
Apply vendor patch. If immediate patching is not feasible, disable ECCSI-based authentication and migrate to alternative signature verification mechanisms (RSA, ECDSA) until patched wolfSSL version is deployed. Restrict network access to systems using wolfSSL ECCSI to prevent adjacent network attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in wolfSSL Cryptographic and Certificate Verification Flaws
View all 7wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
Authentication bypass in wolfSSL TLS clients built with Raw Public Key (RPK) support allows a malicious or on-path serve
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer C
Certificate forgery in the wolfSSL client (versions 5.7.2 through 5.9.2) lets a remote attacker who already holds any ce
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
Exploit-DB