CWE-347: Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Consequences

• Access Control, Integrity, Confidentiality: Gain Privileges or Assume Identity, Modify Application Data, Execute Unauthorized Code or Commands

Recent advisories

• EEF-CVE-2026-65632 — ECDSA signature length is not validated in jose, allowing signature malleability
• GHSA-pxh4-856f-4h89 — PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
• GHSA-j7h2-66j4-ghjf — A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
• GHSA-w2cx-738m-mc7w — PyJWT accepts public JWK containers as HMAC secrets
• GHSA-r6x4-923q-g947 — PyJWT BOM Bypass
• GHSA-p4g4-x82p-q773 — PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
• GHSA-ffc3-869f-jxw9 — PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
• GHSA-9j54-fg26-wv3r — PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
• EEF-CVE-2026-78223 — Token revocation record built from unverified JWT claims in AshAuthentication
• GHSA-5m98-cgcr-xx3q — n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
• PYSEC-2026-3801 — openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable…
• PYSEC-2026-3799 — openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust…
• PYSEC-2026-3778 — openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and…
• PYSEC-2026-3777 — openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by…
• PYSEC-2026-3957 — openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery…

All advisories for CWE-347