CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- dataease sqlbotDataease SQLBot JWT Token auth.py validateEmbedded signature verification6.3 Medium
- aws aws-lc, amazon aws-lc-sys, aws libcrypto +7 more +9 morePKCS7_verify Signature Validation Bypass in AWS-LC8.7 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +3 more +5 moreOrg.keycloak/keycloak-services: webauthn attestation statement verification bypass3.1 Low
- ens.domains ethereum name service, ensdomains ens-contracts +1 moreENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation2.7 Low
- automattic mongooseCesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification6.3 Medium
- bosch infotainment system ecuAbsence of Kernel Module Signature Verification on Linux System of Infotainment ECU6.7 Medium
- goauthentik authentikauthentik has a Signature Verification Bypass via SAML Assertion Wrapping8.8 High
- sap se netweaver as abap and abap platform, sap basis +1 moreXML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform8.8 High
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation8.1 High
- slack nebulaNebula Has Possible Blocklist Bypass via ECDSA Signature Malleability7.6 High
- rapid7 vulnerability managementRapid7 InsightVM Signature Validation Vulnerability9.6 Critical
- drupal commerce payboxPayment bypass in Commerce Paybox8.7 High
- canonical jujuJuju has broken CMR authorization2.1 Low
- rustcrypto signaturesML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices5.3 Medium
- liuyueyi quick-mediaBuffer Overflow Vulnerability in liuyueyi/quick-media5.3 Medium
- openssl'openssl dgst' one-shot codepath silently truncates inputs >16MB5.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata3.1 Low
- phala-network dcap-qvldcap-qvl has Missing Verification for QE Identity9.3 Critical
- celabshq libcrux-ecdh, libcrux-ed25519, libcrux-psq +2 morelibcrux before 0.0.6 Cryptographic Implementation Bug Fixes8.7 High
- theupdateframework go-tufgo-tuf improperly validates the configured threshold for delegations5.9 Medium
- juneandgreen sm-cryptosm-crypto Affected by Signature Forgery in SM2-DSA7.5 High
- juneandgreen sm-cryptosm-crypto Affected by Signature Malleability in SM2-DSA7.5 High
- fleetdm fleetFleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment9.3 Critical
- ibm applinxMultiple vulnerabilities found in IBM ApplinX.7.3 High
- smci x13sem-fSupermicro BMC firmware update validation bypass8.4 High
- smci x12stw-fSupermicro BMC firmware update validation bypass7.2 High
- honoJWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass8.2 High
- honoJWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)8.2 High
- microsoft windows admin center, windows admin center in azure portal +1 moreWindows Admin Center Elevation of Privilege Vulnerability7.5 High
- samrocketman jervisJervis has a JWT Algorithm Confusion Vulnerability6.9 Medium
- iamb crypt::sodium::xs, crypt\ +1 moreCrypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium9.8 Critical
- gnupgIn GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary...5.9 Medium
- gauzy ever gauzyEver Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret9.3 Critical
- altcha-org altcha-libALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay6.5 Medium
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...3.3 Low
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...5.5 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker...5.3 Medium
- foxit pdf editor, pdf reader +1 moreAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before...6.5 Medium
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027,...8.1 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)3.3 Low
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)3.3 Low
- fortinet fortiweb, siemens ruggedcom ape1808 +1 moreAn improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0,...9.1 Critical
- fortinet fortios, fortiproxy, fortiswitchmanager +3 more +5 moreA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0...9.1 Critical
- ivanti endpoint managerImproper verification of cryptographic signatures in the patch management component of Ivanti...7.8 High
- onelogin ruby-samlruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation9.3 Critical
- onelogin ruby-samlruby-saml has a SAML authentication bypass due to namespace handling (parser differential)9.3 Critical
- auth0 node-jwsauth0/node-jws improper HMAC signature verification vulnerability7.5 High
- timlegge xml::sig, xml\ \ +1 moreXML-Sig prior to 0.68 for Perl improperly validates XML without signatures9.3 Critical
- better-authbetter-auth before 1.4.0 Session Revocation via Forged Cookie2.0 Low
github.com/babylonlabs-io/babylonGo,github.com/babylonlabs-io/babylon/v2Go,github.com/babylonlabs-io/babylon/v3Go +1 more +3 moreBabylon's BIP322 signature implementation is not fully compliant to the spec6.9 Medium- Show moreLoading…