CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected...6.9 Medium
- paloaltonetworks cortex xsiam, cortex xsoar, palo alto networks cortex xsiam microsoft teams marketplace +1 more +3 moreCortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration7.2 High
- wolfsslwc_VerifyEccsiHash missing sanity check7.6 High
- sgbett bsv-sdk, bsv-wallet, bsv ruby sdk +1 more +3 morebsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)8.1 High
- helm, red hat helm cli 4.1 +1 moreHelm's plugin verification fails open when .prov is missing, allowing unsigned plugin install8.4 High
- hkuds lightragLightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API4.2 Medium
- openclawOpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass6.9 Medium
- erlang otp, erlang\/otp, erlang\/public key +4 more +6 moreOCSP designated-responder authorization bypass via missing signature verification7.6 High
- sequoia-pgp rpm-sequoia, red hat enterprise linux 10, enterprise linux 9 +2 more +4 moreRust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification4.0 Medium
- hackerbay oneuptimeOneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification8.1 High
- convoypanel convoy, panel +1 moreConvoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users9.8 Critical
@stablelib/ed25519npmStableLib Ed25519 Signature Malleability via Missing S < L Check5.3 Medium- jahlives openssl encryptopenssl_encrypt before 1.4.0 Unverified Key Bundle Encryption9.3 Critical
- arm mbed tls, tf-psa-crypto +1 moreAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is...9.1 Critical
- appsup-dart josejose vulnerable to untrusted JWK header key acceptance during signature verification7.5 High
- pengutronix raucRAUC: Improper Signing of Plain Bundles Exceeding 2 GiB7.2 High
- botan project botanBotan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass5.9 Medium
- frentix openolatOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow9.8 Critical
- zcashfoundation zebra, zebra-consensus +1 moreZebra has a Consensus Failure due to Improper Verification of V5 Transactions8.4 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui Backup Restore Allows Tampering with Encrypted Backups9.4 Critical
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has signature forgery in Ed25519 due to missing S > L check7.5 High
- digitalbazaar forgenode-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding8.7 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 moreForge has signature forgery in RSA-PKCS due to ASN.1 extra field7.5 High
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...6.2 Medium
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic9.1 Critical
- puttyPuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification6.3 Medium
- janmojzis tinysshjanmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification2.0 Low
- yi technology home cameraYi Technology YI Home Camera HTTP Firmware Update ipc signature verification9.2 Critical
github.com/russellhaering/gosaml2GoUnsigned SAML LogoutRequest Acceptance in gosaml27.5 High- goxmldsig project goxmldsig, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +10 more +12 moregoxmldsig has validateSignature Loop Variable Capture Signature Bypass7.5 High
- jetkvm, jetkvm kvm +1 moreJetKVM insufficient firmware verification7.0 High
- connectwise screenconnectScreenConnect Instance Level Cryptographic Material Exposure9.0 Critical
- bitwiseshiftleft stanford javascript crypto librarysjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey8.7 High
- authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 moreAuthlib JWS JWK Header Injection: Signature Verification Bypass9.1 Critical
- hcl aionHCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of...4.8 Medium
- samsung galaxy storeImproper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows...5.9 Medium
- samsung smart switchImproper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15...5.3 Medium
- samsung android, samsung mobile devices +1 moreImproper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1...5.1 Medium
- openclawOpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token8.8 High
- philips hue bridge, hue bridge v2 firmware +1 morePhilips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability6.3 Medium
- emmansun gmsmGo ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability7.5 High
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 morePyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High
- misskeyHTTP signature verification can be bypassed7.1 High
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 moreSignature bypass on update upload7.2 High
- mkj dropbearmkj Dropbear S Range Check curve25519.c unpackneg signature verification6.3 Medium
- pac4j pac4j-jwtpac4j-jwt JwtAuthenticator Authentication Bypass9.3 Critical
- authlib, red hat ansible automation platform 2.6, quay 3.10 +5 more +7 moreAuthlib: Setting `alg: none` and a blank signature appears to bypass signature verification7.7 High
libcrux-ml-dsacrates.iolibcrux has an Incorrect Check of Signer Response Norm During Verification8.7 High- seppmail secure email gateway, seppmail +1 morePGP Signature Reflection6.9 Medium
- seppmail secure email gateway, seppmail +1 moreMissing PGP Signature Tag6.9 Medium
- Show moreLoading…