CVE-2026-4600 — Vulnetix

CVE-2026-4600 PUBLISHED CVSS 7.400000095367432 HIGH

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

EPSS 0.01% · 1.3th percentile

Risk Scores

CVSS 3.1

7.400000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P

EPSS Score

0.01%

1.3th percentile

Affected Products

Vendor	Product	Versions
n/a	jsrsasign	0, 0, 0
npm	jsrsasign	0
jsrsasign_project	jsrsasign	0, 0, 0

Exploit Intelligence

https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7 (nist-nvd)
CIRCL seen: CVE-2026-4600 (circl-sighting)
CIRCL seen: CVE-2026-4600 (circl-sighting)
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940 (circl)
https://github.com/kjur/jsrsasign/pull/646 (circl)
https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60 (circl)
GitHub Gist: bf15ddc097176e951659a24a8e9002a7 (github)
GitHub Gist: bf15ddc097176e951659a24a8e9002a7 (github)
GitHub Gist: bf15ddc097176e951659a24a8e9002a7 (github)

Timeline

Mar 23, 2026 CVE Published
Mar 23, 2026 EPSS Score
Mar 23, 2026 PoC Published
Mar 24, 2026 EPSS Score
Mar 24, 2026 PoC Published
Mar 25, 2026 EPSS Score
Mar 25, 2026 Coalition ESS Score
Mar 26, 2026 EPSS Score
Mar 26, 2026 Coalition ESS Score
Mar 27, 2026 Coalition ESS Score
Mar 29, 2026 Security Advisory
Mar 30, 2026 CVE Updated

References

Open in Interactive Console →