CVE-2026-103902 Details
Description
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.
A vulnerability allowing the creation of forged digital signatures has been identified in DigiDoc libdigidocpp, DigiDoc4, DigiDoc Android, and DigiDoc iOS. This issue arises from improper verification of cryptographic signatures, leading affected DigiDoc software to mistakenly validate these forged signatures as genuine. The vulnerability affects libdigidocpp versions 4.0.0 prior to 4.5.0, DigiDoc4 versions 4.6.0 prior to 4.11.0, and DigiDoc Android and iOS versions 2.7.0 prior to 3.1.0.
Users can update to the latest version of the DigiDoc application. For DigiDoc4, the new version 26.7 is available, which includes security improvements. This version can be downloaded from the ID.ee website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-eid/libdigidocpp/pull/735 | ENISA | Source CodeVendor |
| https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/ | ENISA | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | ENISA |
Affected Products
| Product | Versions |
|---|---|
| DigiDoc libdigidocpp | >= 4.0.0, < 4.5.0 (semver) |
CPE
Remediation
| |
| DigiDoc DigiDoc4 | >= 4.6.0, < 4.11.0 (semver) |
CPE
Remediation
| |
| DigiDoc DigiDoc Android | >= 2.7.0, < 3.1.0 (semver) |
CPE
Remediation
| |
| DigiDoc DigiDoc iOS | >= 2.7.0, < 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | ENISA |