CVE-2026-4600 Details
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
A vulnerability exists in the jsrsasign package, specifically in versions prior to 11.1.1, due to improper validation of DSA domain parameters during signature verification. This flaw allows an attacker to forge DSA signatures or X.509 certificates that are accepted by the X509.verifySignature() method. The vulnerability arises because the DSA verification process does not check that the domain parameters are valid, enabling the creation of signatures that bypass security checks.
Users are advised to upgrade the jsrsasign package to version 11.1.1 or higher, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | redhat-SADP |
| CWE-347 | Improper Verification of Cryptographic Signature | CISA-ADP |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kjur jsrsasign | < 11.1.1 |
CPE
Remediation
| |
Change History
17 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | [email protected] |
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | CVE Modified | [email protected] |
| Jun 22, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | New CVE Received | [email protected] |