PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4600 Kjur CVE debrief

CVE-2026-4600 is a HIGH severity vulnerability (CVSS Score: 8.1) affecting versions of the jsrsasign package before 11.1.1. The vulnerability involves Improper Verification of Cryptographic Signature via DSA domain-parameter validation. An attacker can exploit this by supplying malicious domain parameters (e.g., g=1, y=1, and a fixed r=1) to forge DSA signatures or X.509 certificates that are accepted by X509.verifySignature(). This issue impacts users of jsrsasign, particularly those using DSA for cryptographic operations. The vulnerability was published on March 23, 2026, and last modified on June 22, 2026.

Vendor
Kjur
Product
jsrsasign
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-23
Original CVE updated
2026-09-10
Advisory published
2026-03-23
Advisory updated
2026-09-10

Who should care

Developers and security teams using the jsrsasign package, especially those relying on DSA for cryptographic operations, should prioritize updating to version 11.1.1 or later. Organizations that utilize jsrsasign for digital signatures or certificate verification are at risk and need to assess their exposure and take appropriate action.

Technical summary

The vulnerability is caused by improper verification of cryptographic signatures in the jsrsasign package. Specifically, the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic and related DSA/X509 verification flows in src/dsa-2.0.js are flawed. An attacker can forge DSA signatures or X.509 certificates by providing malicious domain parameters, such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash. This affects all versions before 11.1.1 of jsrsasign.

Defensive priority

High priority due to potential for signature forgery and certificate impersonation.

Recommended defensive actions

  • Update jsrsasign to version 11.1.1 or later.
  • Review and validate DSA usage in your applications.
  • Implement additional verification checks for cryptographic signatures.
  • Monitor for suspicious signature verification activities.
  • Consider alternative cryptographic algorithms if possible.

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE records. The vulnerability affects jsrsasign versions before 11.1.1. The issue involves DSA domain-parameter validation and the potential for forging signatures or certificates. Defenders should verify their use of jsrsasign, check their current version, and review DSA usage in their applications.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4600 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4600

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4600 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4600

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.