Skip to main content

Improper Verification of Cryptographic Signature

CVE-2026-45575

Low
0/10

Summary

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects 'uri_puk_idp_enc' and 'uri_puk_idp_sig' to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material. This issue affects epa4all-client versions prior to 1.2.2.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-347 - Improper Verification of Cryptographic Signature

A cryptographic protocol is meant to ensure that services are provided in a secure manner. An application with absent or improper verification of cryptographic signatures allows malicious users to feed false messages to valid users or to disclose sensitive data, subverting the goals of the protocol. This can lead to security failures such as false authentication, account hijacking, and privilege escalation.

References

Advisory Timeline

  • Published