Read the docs
TI-2026-04004 Aliases CVE-2026-4600GHSA-wvqx-v3f6-w8rh

Improper signature verification in jsrsasign

Priority HIGH 74CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jsrsasign: 11.1.1jsrsasign (npm): 11.1.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jsrsasignbefore 11.1.111.1.1Patch availableCNA
—org.webjars.npm:jsrsasignall versions—No fix listedCNA
—jsrsasign (npm)before 11.1.111.1.1Patch availableGHSA-wvqx-v3f6-w8rh
  • jsrsasign Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available CNA
  • org.webjars.npm:jsrsasign Vendor— Affected all versions Fixed in — No fix listed CNA
  • jsrsasign (npm) Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available GHSA-wvqx-v3f6-w8rh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:*before 11.1.1VulnerableKjur
  • cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:* Versions before 11.1.1 Vulnerable ·Kjur

Remediation

  • Fix · CNA jsrsasign Fixed in 11.1.1
  • Fix · GHSA-wvqx-v3f6-w8rh jsrsasign (npm) Fixed in 11.1.1 Advisory →

Red Hat 7 advisories

  • RHSA-2026:19410 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19409 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
    Red Hat Quay 3.16.4
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
Show 4 more Red Hat advisories
  • RHSA-2026:6926 Released 2026-04-07 · Red Hat rating Important
    Red Hat Quay 3.9.20
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6912 Released 2026-04-07 · Red Hat rating Important
    Red Hat Quay 3.10.20
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6720 Released 2026-04-06 · Red Hat rating Important
    Red Hat Quay 3.12.16
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jsrsasign 11.1.1

    6 records Highest priority Priority HIGH 3 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-04006 Incorrect numeric conversion in jsrsasignPriority HIGH 77
    • TI-2026-04002 Infinite loop in jsrsasignPriority HIGH 77
    • TI-2026-04003 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to…Priority MEDIUM 49
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Migration Toolkit for Virtualization 2.10Fixed RHSA-2026:19409
Migration Toolkit for Virtualization 2.9Fixed RHSA-2026:19410
Red Hat Quay 3.10Fixed RHSA-2026:6912
Red Hat Quay 3.12Fixed RHSA-2026:6720
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:19375
Red Hat Quay 3.9Fixed RHSA-2026:6926
Not affected: 7 products
  • Migration Toolkit for Virtualization 2.10
  • Migration Toolkit for Virtualization 2.9
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4600
  2. 2026-10-03 Alias added: GHSA-wvqx-v3f6-w8rh
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10 · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 12

  • TI-2026-04006 Incorrect numeric conversion in jsrsasign CVSS 4.0HIGH 8.7
  • TI-2026-04002 Infinite loop in jsrsasign CVSS 4.0HIGH 8.7
  • TI-2026-04003 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to… CVSS 4.0CRITICAL 9.3
  • TI-2020-11771 An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. CVSS 3.1CRITICAL 9.8
  • TI-2020-11770 An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. CVSS 3.1CRITICAL 9.8
  • TI-2022-09454 Improper verification of cryptographic signature in jsrsasign CVSS 3.1CRITICAL 9.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences