Read the docs
TI-2026-07960 Aliases CVE-2026-9058GHSA-7hq7-5m7p-r2pp

Improper Certificate Verification in Szafir SDK

Priority MEDIUM 48CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified". For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined". This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application. This issue was fixed in version 1.8.463.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Fix Fixed Szafir SDK (Krajowa Izba Rozliczeniowa): 1.8.463.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Krajowa Izba RozliczeniowaSzafir SDKbefore 1.8.463.21.8.463.2Patch availableCNA

Remediation

  • Fix · CNA Szafir SDK (Krajowa Izba Rozliczeniowa) Fixed in 1.8.463.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9058
  2. 2026-10-03 Alias added: GHSA-7hq7-5m7p-r2pp

References

Advisory 1

Other 1

  • TI-2026-21415 Lack of Dynamic Library Validation in SzafirHost CVSS 4.0HIGH 8.7
  • TI-2026-32104 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
  • TI-2026-11178 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
  • TI-2026-82552 Szafir accepts unvalidated TLS certificates for update downloads CVSS 4.0MEDIUM 6.9
  • TI-2026-82528 XML external entity injection in Szafir and Szafir Weryfikująca CVSS 4.0HIGH 8.2
  • TI-2026-21414 URL (HTTP Origin) call location spoofing in Szafir SDK Web CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences