CVE-2026-9058

Improper Certificate Verification in Szafir SDK

Assigner: CERT-PL
Reserved: 20.05.2026 Published: 25.05.2026 Updated: 25.05.2026

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Krajowa Izba Rozliczeniowa
Product	Szafir SDK
Versions	Default: unaffected affected from 0 to 463 (excl.)

Vendor

Krajowa Izba Rozliczeniowa

Product

Szafir SDK

Versions

Default: unaffected

affected from 0 to 463 (excl.)

Credits

Michał Leszczyński (icedev.pl) finder

References

Problem Types

CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') CWE
CWE-393: Return of Wrong Status Code CWE

Impacts

CAPEC-115 Authentication Bypass