GHSA-c27r-x354-4m68
xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion
Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.
Patches
Version 2.0.0 has the fix.
Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.
What each source reports
GitHub AdvisoriesNo score
xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion
Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.
Patches
Version 2.0.0 has the fix.
Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.
- Record
GHSA-c27r-x354-4m68- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVNo score
xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion
Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.
Patches
Version 2.0.0 has the fix.
Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.
- Record
GHSA-c27r-x354-4m68- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xml-cryptonpm | through 1.5.3 | 2.0.0 |
xml-cryptonpm | before 2.0.0 | 2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-c27r-x354-4m68 is a vulnerability with no CVSS score yet in xml-crypto, published October 27, 2020. No source lists public exploit code. Fixed in xml-crypto 2.0.0.