CWE-347: Improper Verification of Cryptographic Signature
Filter
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
What the weakness is: CWE-347 at MITRE
Ask an AI about CWE-347
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-347: Improper Verification of Cryptographic Signature and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/347.html and https://cve.bz/cve/cwe/347?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.7CVE-2026-91908
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading …
- 6.4CVE-2026-91905
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesyst…
- 4.2CVE-2026-117549
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, whe…
- –CVE-2026-116474EPSS 0.1%
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without require…
- 8.1CVE-2026-63182EPSS 0.2%
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound …
- 7.5CVE-2026-46560EPSS 0.2%
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive pa…
- –CVE-2026-119037EPSS 0.1%
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both …
- 7.6CVE-2026-119561EPSS 0.2%
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL …
- –CVE-2026-118559EPSS 0.10%
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- 3.7CVE-2026-118774EPSS 0.1%
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input …
- 5.9CVE-2026-118768EPSS 0.07%
Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signe…
- 4.3CVE-2026-88078EPSS 0.3%
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- 7.5CVE-2026-33923EPSS 0.2%
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bu…
- –CVE-2026-110985EPSS 0.1%
A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifi…
- 7.5CVE-2026-118040EPSS 0.09%
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticat…
- 5.9CVE-2026-87879EPSS 0.2%
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 7.4CVE-2026-87103EPSS 0.2%
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 7.4CVE-2026-87102EPSS 0.2%
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 6.2CVE-2026-87101EPSS 0.10%
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 6.9CVE-2026-106078EPSS 0.3%
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
- 8.6CVE-2026-117602EPSS 0.1%
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature.…
- 9.3CVE-2026-117601EPSS 0.2%
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transa…
- 3.7CVE-2026-103325EPSS 0.1%
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers…
- 5.1CVE-2026-65632EPSS 0.09%
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its a…
- 8.4CVE-2026-116116EPSS 0.09%
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be …
- 7.7CVE-2026-116189EPSS 0.1%
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path ca…
- 8.6CVE-2026-56837EPSS 0.2%
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only …
- 6.3CVE-2026-89317EPSS 0.1%
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, …
- 9.1CVE-2026-114615EPSS 0.2%
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a by…
- 7.1CVE-2026-115374EPSS 0.2%
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header t…
- 4.8CVE-2026-87947EPSS 0.1%
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
- 3.7CVE-2026-84918EPSS 0.2%
Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
- 9.2CVE-2026-105869EPSS 0.3%
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorizatio…
- 9.1CVE-2026-10141EPSS 0.3%
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can …
- 9.8CVE-2026-113620EPSS 0.3%
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token wh…
- 5.1CVE-2026-109838EPSS 0.08%
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
- 9.1CVE-2026-102946EPSS 0.1%
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures ar…
- 8.2CVE-2026-110765EPSS 0.2%
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment I…
- 7.5CVE-2026-95633EPSS 0.3%
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…
- 7.5CVE-2026-95632EPSS 0.5%
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…
- 7.5CVE-2026-103297EPSS 0.5%
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…
- 7.5CVE-2026-103296EPSS 0.5%
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…
- 5.3CVE-2026-102502EPSS 0.4%
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain una…
- 7.8CVE-2026-97799EPSS 0.3%
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2026-96957EPSS 0.5%
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
- 9.1CVE-2026-96252EPSS 0.6%
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- 7.5CVE-2026-87696EPSS 0.4%
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 9.0CVE-2026-85818EPSS 0.4%
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
- 5.5CVE-2026-83798EPSS 0.2%
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.
- 5.5CVE-2026-70071EPSS 0.3%
Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.