PatchSiren cyber security CVE debrief
CVE-2026-4600 Kjur CVE debrief
CVE-2026-4600 is a HIGH severity vulnerability (CVSS Score: 8.1) affecting versions of the jsrsasign package before 11.1.1. The vulnerability involves Improper Verification of Cryptographic Signature via DSA domain-parameter validation. An attacker can exploit this by supplying malicious domain parameters (e.g., g=1, y=1, and a fixed r=1) to forge DSA signatures or X.509 certificates that are accepted by X509.verifySignature(). This issue impacts users of jsrsasign, particularly those using DSA for cryptographic operations. The vulnerability was published on March 23, 2026, and last modified on June 22, 2026.
- Vendor
- Kjur
- Product
- jsrsasign
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-03-23
- Original CVE updated
- 2026-09-10
- Advisory published
- 2026-03-23
- Advisory updated
- 2026-09-10
Who should care
Developers and security teams using the jsrsasign package, especially those relying on DSA for cryptographic operations, should prioritize updating to version 11.1.1 or later. Organizations that utilize jsrsasign for digital signatures or certificate verification are at risk and need to assess their exposure and take appropriate action.
Technical summary
The vulnerability is caused by improper verification of cryptographic signatures in the jsrsasign package. Specifically, the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic and related DSA/X509 verification flows in src/dsa-2.0.js are flawed. An attacker can forge DSA signatures or X.509 certificates by providing malicious domain parameters, such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash. This affects all versions before 11.1.1 of jsrsasign.
Defensive priority
High priority due to potential for signature forgery and certificate impersonation.
Recommended defensive actions
- Update jsrsasign to version 11.1.1 or later.
- Review and validate DSA usage in your applications.
- Implement additional verification checks for cryptographic signatures.
- Monitor for suspicious signature verification activities.
- Consider alternative cryptographic algorithms if possible.
Evidence notes
The primary evidence for this vulnerability comes from the NVD and CVE records. The vulnerability affects jsrsasign versions before 11.1.1. The issue involves DSA domain-parameter validation and the potential for forging signatures or certificates. Defenders should verify their use of jsrsasign, check their current version, and review DSA usage in their applications.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-4600 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-4600
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-4600 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4600
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7
[email protected] - Exploit, Mitigation, Third Party Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60
[email protected] - Patch
-
Source reference
Unverified legacy reference
URL: https://github.com/kjur/jsrsasign/pull/646
[email protected] - Issue Tracking
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940
[email protected] - Third Party Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.