CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedA lack of cryptographic signature verification in the validateAccessToken function of bookcars v8...9.8 Critical
- siemens kaskas's late signature validation may allow unnoticed repository manipulations2.1 Low
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE vulnerable to ECDH private key recovery4.7 Medium
- djangoproject djangoSigned cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie2.3 Low
- siemens kaskas checks out SHA-like git branches as valid commits2.1 Low
- sensiolabs symfony, symfony twilio-notifier +1 moreSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection6.9 Medium
- goauthentik authentikauthentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user8.5 High
- sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 moreSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection6.9 Medium
- jpadilla pyjwtPyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys5.4 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 High
- jpadilla pyjwtPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes4.2 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security policy bypass in jwe-encrypted request object processing5.9 Medium
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +11 more +13 moreInsufficient Verification of Data Authenticity8.7 High
- No product listedNorthern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.5.3 Medium
- @fedify fedifyFedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring7.0 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 moreInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh7.5 High
- coderCoder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft9.1 Critical
- com.oviva.telematik epa4all-clientepa4all-client: Improper Verification of Cryptographic Signature7.4 High
- benmcollins libjwtLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC9.1 Critical
- amd radeon™ rx 7000 series graphics productsImproper verification of cryptographic signature in the Radeon RGB tool could allow a malicious...7.0 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 morePAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled7.2 High
- th30d4y openlearnxOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover6.9 Medium
- microsoft azure sdk for javaAzure SDK for Java Security Feature Bypass Vulnerability9.1 Critical
- zen-browser desktopZen Browser MAR updater ships with signature verification removed — unsigned updates accepted8.0 High
- sigstore gitsigngitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits5.3 Medium
- useplunk plunkPlunk: SNS webhook forgery9.1 Critical
- zcashfoundation zebraZebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output8.3 High
- bitcoinjbitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass7.5 High
- zcashfoundation zebraZebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling8.3 High
- zcashfoundation zebra, zfnd zebra-script, zebrad +2 moreZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer9.3 Critical
- go toolchain cmd/go, golang go +1 moreMalicious module proxy can bypass checksum database in cmd/go7.5 High
com.getaxonflow:axonflow-sdkMavenaxonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Medium@axonflow/sdknpmaxonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Mediumgithub.com/getaxonflow/axonflow-sdk-goGo,github.com/getaxonflow/axonflow-sdk-go/v2Go,github.com/getaxonflow/axonflow-sdk-go/v3Go +2 more +4 moreaxonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 MediumaxonflowPyPIaxonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Medium- open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 moreazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay8.1 High
libcrux-ml-dsacrates.iolibcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case8.2 High- dolibarr erp crmDolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification6.3 Medium
- admidioAdmidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed8.2 High
- elastic package registryImproper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass5.9 Medium
- netmakerNetmaker does not verify JWT signatures for host tokens8.2 High
- automattic mongooseCesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification6.3 Medium
github.com/supply-chain-tools/gitverifyGogitverify has improper tag signature verification5.3 Medium- amazon tough, tuftool +1 moreSignature Threshold Bypass in awslabs/tough Delegated Roles7.0 High
- aws ops wheelAuthentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel9.3 Critical
- nimiq nimiq-transaction, proof-of-stake +1 morenimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge6.8 Medium
- microsoft asp.net core, asp.net core 10.0, visual studio 2026 version 18.5 +4 more +6 moreASP.NET Core Elevation of Privilege Vulnerability9.1 Critical
- jconti payment gateway for redsys & woocommerce litePayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation7.5 High
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.6.3 Medium
- xquic project xquicXQUIC Improper STREAM Frame Validation in Initial/Handshake Packets8.3 High
- Show moreLoading…