CVE-2026-16027 PUBLISHED

Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature

Assigner: TR-CERT
Reserved: 17.07.2026 Published: 07.08.2026 Updated: 07.08.2026

Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery.

This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor Revenue Administration
Product E-Signature
Versions Default: unaffected
  • affected from 2.4.4.0 to 2.5.1.0 (excl.)

Credits

  • Sangsoo Jeong finder

References

Problem Types

  • CWE-918 Server-Side request forgery (SSRF) CWE

Impacts

  • CAPEC-664 Server Side Request Forgery