CWE-347 · Improper Verification of Cryptographic Signature

878 CVEs classified under CWE-347 (Improper Verification of Cryptographic Signature). Browse by severity and year.

Top CVEs for CWE-347
CVESeverityScorePublishedSummary
CVE-2026-5430Critical10.02026-08-06The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a…
CVE-2026-56451Critical10.02026-07-14A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON We…
CVE-2026-54782Critical10.02026-07-08CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token val…
CVE-2026-48558Critical10.02026-06-12SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC aut…
CVE-2025-54419Critical10.02025-07-28A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response documen…
CVE-2023-25574Critical10.02025-02-25`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-lt…
CVE-2024-45409Critical10.02024-09-10The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signa…
CVE-2024-32962Critical10.02024-05-02xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the s…
CVE-2022-24884Critical10.02022-05-06ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature value…
CVE-2021-33885Critical10.02021-08-25An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the…
CVE-2020-2021Critical10.02020-06-29When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), impro…
CVE-2026-44748Critical9.92026-06-09SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modif…
CVE-2024-21669Critical9.92024-01-11Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments…
CVE-2022-39366Critical9.92022-10-28DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig…
CVE-2026-56207Critical9.82026-09-09Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as anoth…
CVE-2026-86304Critical9.82026-09-06MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust…
CVE-2026-76581Critical9.82026-08-28The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and…
CVE-2026-81701Critical9.82026-08-27openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn…
CVE-2026-81700Critical9.82026-08-27openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl…
CVE-2026-19505Critical9.82026-08-19Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentic…
All CVEs classified under CWE-347 — newest first (page 1 of 9)
CVESeverityScorePublishedSummary
CVE-2026-102273High7.42026-09-28PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only…
CVE-2026-102272High7.42026-09-28PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-…
CVE-2026-102271High7.42026-09-28PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard…
CVE-2026-102268Critical9.12026-09-28PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recogni…
CVE-2026-102266High7.42026-09-28PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used…
CVE-2026-944182026-09-27Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges th…
CVE-2025-71422Medium5.72026-09-27Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host…
CVE-2026-844652026-09-25Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email…
CVE-2026-618552026-09-25Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed e…
CVE-2026-567272026-09-25Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the g…
CVE-2026-97732Medium5.12026-09-25IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate st…
CVE-2026-97731High7.12026-09-25MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSigne…
CVE-2026-57178High7.42026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou…
CVE-2026-911872026-09-24Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary…
CVE-2026-91814Medium5.32026-09-23A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content m…
CVE-2026-18152High7.42026-09-22IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cry…
CVE-2026-85995High7.32026-09-22Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP…
CVE-2026-95503Medium6.82026-09-22A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication…
CVE-2026-75939High7.42026-09-21A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors befo…
CVE-2026-94368High7.12026-09-21A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv…
CVE-2026-9832Medium5.32026-09-19The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and…
CVE-2026-59163Critical9.12026-09-18Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and p…
CVE-2026-93657High7.52026-09-18hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing inv…
CVE-2026-28199Low3.32026-09-18An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a sp…
CVE-2026-28198High8.82026-09-18An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a p…
CVE-2026-545812026-09-17mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap in…
CVE-2026-86038High7.52026-09-17libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in package…
CVE-2026-782232026-09-17Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a…
CVE-2026-92718High7.32026-09-16Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verif…
CVE-2026-42784High7.42026-09-16A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discre…
CVE-2026-865852026-09-16The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who control…
CVE-2026-86109Medium6.62026-09-16The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the d…
CVE-2026-58200High7.12026-09-15Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with cl…
CVE-2026-54155High7.72026-09-14node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-se…
CVE-2026-57122High8.62026-09-14PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or…
CVE-2026-87802Critical9.12026-09-14Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att…
CVE-2026-54248Medium6.52026-09-11Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1…
CVE-2026-80469High8.32026-09-11An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, a…
CVE-2026-73784High8.82026-09-11A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.
CVE-2026-891692026-09-11live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
CVE-2026-89086Critical9.12026-09-10In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the…
CVE-2026-89043High7.42026-09-10passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent X…
CVE-2026-89042Critical9.12026-09-10passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by…
CVE-2023-54355High7.52026-09-09PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers…
CVE-2026-79970Medium5.62026-09-09Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verification of Cryptograph…
CVE-2026-56207Critical9.82026-09-09Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as anoth…
CVE-2026-87732Medium6.22026-09-09An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into funct…
CVE-2026-86080Medium5.32026-09-08n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when…
CVE-2026-52486Medium6.62026-09-08An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module
CVE-2026-69646High8.32026-09-08Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
CVE-2026-28590High7.82026-09-08In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privileg…
CVE-2026-57098High7.52026-09-08Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-77105High8.82026-09-08CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Up…
CVE-2026-14296High7.52026-09-07When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without addition…
CVE-2026-86304Critical9.82026-09-06MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust…
CVE-2026-67278Critical9.12026-09-05MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentic…
CVE-2026-67276High8.12026-09-05RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus…
CVE-2026-52767High8.22026-09-05YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl…
CVE-2026-79389High7.42026-09-04Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT mes…
CVE-2026-85525High7.42026-09-04Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCS…
CVE-2026-80098Critical9.32026-09-03Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-84185Medium5.92026-09-03A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the l…
CVE-2026-85394Critical9.12026-09-03python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefi…
CVE-2026-85393High7.52026-09-03node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed…
CVE-2026-80465High8.72026-09-03A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3)…
CVE-2026-829552026-09-02In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had…
CVE-2026-73776High7.92026-09-01A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious ac…
CVE-2026-82876High8.22026-08-31Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutabl…
CVE-2026-82645High8.62026-08-30AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a…
CVE-2026-757592026-08-30Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encryp…
CVE-2026-82461High8.12026-08-29pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can f…
CVE-2026-82454Critical9.12026-08-29The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken fu…
CVE-2026-76581Critical9.82026-08-28The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and…
CVE-2026-54330High8.12026-08-28Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway…
CVE-2026-81717Low3.52026-08-27openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d…
CVE-2026-81714High7.02026-08-27openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho…
CVE-2026-81701Critical9.82026-08-27openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn…
CVE-2026-81700Critical9.82026-08-27openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl…
CVE-2026-81680Medium4.02026-08-27openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo…
CVE-2026-579102026-08-25Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevat…
CVE-2026-759462026-08-21A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a…
CVE-2026-68745High8.12026-08-21Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML resp…
CVE-2026-62834Critical9.32026-08-20Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-72861Medium5.82026-08-20The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src…
CVE-2026-19505Critical9.82026-08-19Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentic…
CVE-2026-76234High7.52026-08-19libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check len…
CVE-2026-50720Medium6.42026-08-19The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SH…
CVE-2026-50719Medium6.82026-08-19The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the s…
CVE-2026-72889Critical9.82026-08-19Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the sig…
CVE-2026-58085High7.52026-08-19After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The drive…
CVE-2026-55165Medium4.82026-08-18Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] fr…
CVE-2025-9210High8.12026-08-18Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate pri…
CVE-2021-43716Critical9.82026-08-18Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware th…
CVE-2026-74901Critical9.82026-08-17openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenti…
CVE-2026-74876Critical9.82026-08-17openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying sig…
CVE-2026-18500High8.12026-08-15@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently…
CVE-2026-74244Medium5.92026-08-14A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending cra…
CVE-2026-19910High7.52026-08-14PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacker…
CVE-2026-471922026-08-14kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configura…
CVE-2026-471912026-08-14kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a r…