CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name 8.7 High
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation 6.3 Medium
- openidentityplatform openam OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation 7.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.4 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.8 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.8 Medium
- chartbrew Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens 7.5 High
- tracecathq tracecat Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 9.8 Critical
- chainguard minio MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read. 8.8 High
- signalwire freeswitch FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY 9.1 Critical
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 more Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High
- red hat build of keycloak 26.6, build of keycloak 26.6.9, single sign-on 7 +2 more Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names 9.1 Critical
- gpustack GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover 9.1 Critical
- wp hosting pay with vipps and mobilepay for woocommerce Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery 6.3 Medium
- phoenix contact plcnext engineer Missing GSDX SignatureValue verification 6.9 Medium
- qihoo 360 d600-2, d603-2, d606-6 +3 more +5 more Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 10.0 Critical
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper... 6.4 Medium
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper... 8.1 High
- mpdavis python-jose python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key 9.1 Critical
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of... 6.4 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of... 5.7 Medium
- @fastify/secure-session @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal 4.2 Medium
- gitea Gitea Actions job token spoofing of instance-signed commits 6.5 Medium
- litesaml lightsaml LightSAML: Signature reference wrapping permits unsigned assertion claims 8.1 High
- No product listed Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty 7.5 High
- phpmyadmin phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer 7.6 High
- digitalbazaar forge Forge: Certificate signature verified with the issuer's RSA signature scheme 3.7 Low
- randombit botan Botan: CLI utility `ocsp_check` accepts unauthenticated responses 5.9 Medium
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Spoofing Vulnerability 4.3 Medium
- hashgraph guardian, nozomi networks cmc +1 more Update bundle signature bypass in Guardian/CMC before 26.4.0 7.5 High
- drupal commerce stripe Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 5.3 Medium
- apache software foundation kafka Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured 9.1 Critical
- progress software telerik document processing libraries Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing 7.5 High
- acronis cyber protect 17 Sensitive information disclosure due to improper token validation. The following products are... 5.9 Medium
- acronis cyber protect 17 Sensitive information disclosure and manipulation due to improper token validation. The following... 7.4 High
- acronis cyber protect 17 Sensitive information disclosure and manipulation due to improper token validation. The following... 7.4 High
- acronis cyber protect 17 Sensitive information disclosure due to improper token validation. The following products are... 6.2 Medium
- veeam backup for microsoft 365 A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a... 6.9 Medium
- spesmilo electrum Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution 8.6 High
- spesmilo electrum Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions 9.3 Critical
- unknown tiendacrypto para woocommerce TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass 3.7 Low
- apple ipados, macos, tvos +4 more +6 more An issue with signature validation was addressed with improved checks. This issue is fixed in iOS... 6.3 Medium
- appsup-dart jose ECDSA signature length is not validated in jose, allowing signature malleability 5.1 Medium
- yoosee gm8135s camera Yoosee GM8135S Camera Secure Boot signature verification 9.3 Critical
- rclone rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS 7.7 High
- eclipse foundation keypont - gose JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) 6.3 Medium
- authlib Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys 7.4 High
- lxc incus Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs 7.1 High
- apache software foundation pulsar Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role 9.2 Critical
- google chrome Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- Show olderLoading…