CVE-2026-9058
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Szafir SDK automatically downloads and imports untrusted CA certificates from the AIA caIssuers URI extension, which can lead to incorrectly treating a digital signature as valid. This flaw enables authentication bypass and user impersonation.
Risk Assessment
Risk of accepting forged digital signatures and user impersonation in applications integrating Szafir SDK.
Recommendation
Update Szafir SDK to version 1.8.463.2 or later.
Original NVD description (English source)
For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified". For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined". This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application. This issue was fixed in version 1.8.463.2.