CWE-347
AllowedImproper Verification of Cryptographic Signature
Abstraction: Base · Status: Draft
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
1346 vulnerabilities reference this CWE, most recent first.
GHSA-75RW-34Q6-72CR
Vulnerability from github – Published: 2022-06-17 00:38 – Updated: 2023-03-07 00:39Impact
The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level.
As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability.
Patches
The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification.
Workarounds
There is no known workaround, any use of Biscuit v1 should be migrated to v2.
References
Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin
For more information
If you have any questions or comments about this advisory: * Open an issue in biscuit-auth/biscuit * Ask questions on Matrix
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "biscuit-auth"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/biscuit-auth/biscuit-go"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.clever-cloud:biscuit-java"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31053"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-17T00:38:03Z",
"nvd_published_at": "2022-06-13T20:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nThe paper [Cryptanalysis of Aggregate \u0393-Signature and Practical Countermeasures in Application to Bitcoin](https://eprint.iacr.org/2020/1484) defines a way to forge valid \u0393-signatures, an algorithm that is used in the Biscuit specification version 1.\nIt would allow an attacker to create a token with any access level.\n\nAs Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2.\nWe are not aware of any active exploitation of this vulnerability.\n\n### Patches\n\nThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification.\n\n### Workarounds\n\nThere is no known workaround, any use of Biscuit v1 should be migrated to v2.\n\n### References\n[Cryptanalysis of Aggregate \u0393-Signature and Practical Countermeasures in Application to Bitcoin](https://eprint.iacr.org/2020/1484)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [biscuit-auth/biscuit](https://github.com/biscuit-auth/biscuit)\n* Ask questions on [Matrix](https://matrix.to/#/#biscuit-auth:matrix.org)\n",
"id": "GHSA-75rw-34q6-72cr",
"modified": "2023-03-07T00:39:38Z",
"published": "2022-06-17T00:38:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31053"
},
{
"type": "WEB",
"url": "https://eprint.iacr.org/2020/1484"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-75rw-34q6-72cr"
},
{
"type": "PACKAGE",
"url": "https://github.com/biscuit-auth/biscuit"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0564"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Signature forgery in Biscuit"
}
GHSA-76XF-M95X-GXHF
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2011-3965"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-02-09T04:10:00Z",
"severity": "MODERATE"
},
"details": "Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.",
"id": "GHSA-76xf-m95x-gxhf",
"modified": "2022-05-13T01:27:14Z",
"published": "2022-05-13T01:27:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3965"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14954"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=109664"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-777R-H845-392R
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2025-12-31 03:30GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching hash. This can cause the client to download and install a tampered update, resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on some Linux deployments. A local attacker who can modify proxy settings may also abuse this behavior to escalate privileges by forcing installation of a crafted update.
{
"affected": [],
"aliases": [
"CVE-2025-34324"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T17:16:00Z",
"severity": "HIGH"
},
"details": "GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching hash. This can cause the client to download and install a tampered update, resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on some Linux deployments. A local attacker who can modify proxy settings may also abuse this behavior to escalate privileges by forcing installation of a crafted update.",
"id": "GHSA-777r-h845-392r",
"modified": "2025-12-31T03:30:32Z",
"published": "2025-11-18T18:32:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34324"
},
{
"type": "WEB",
"url": "https://infocert.digital/consumer/gosign-suite"
},
{
"type": "WEB",
"url": "https://www.ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution"
},
{
"type": "WEB",
"url": "https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/gosign-desktop-insecure-update-mechanism-rce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-77FH-VC7F-W685
Vulnerability from github – Published: 2022-05-01 02:05 – Updated: 2024-02-08 21:30Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
{
"affected": [],
"aliases": [
"CVE-2005-2182"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-07-11T04:00:00Z",
"severity": "MODERATE"
},
"details": "Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the \"Messages waiting\" message.",
"id": "GHSA-77fh-vc7f-w685",
"modified": "2024-02-08T21:30:31Z",
"published": "2022-05-01T02:05:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2182"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21260"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=112067698624686\u0026w=2"
},
{
"type": "WEB",
"url": "http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/alerts/2005/Jul/1014407.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-77MP-2CR5-W6PC
Vulnerability from github – Published: 2022-05-14 01:36 – Updated: 2022-05-14 01:36A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user.
{
"affected": [],
"aliases": [
"CVE-2018-18203"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-28T23:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle\u0027s USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user.",
"id": "GHSA-77mp-2cr5-w6pc",
"modified": "2022-05-14T01:36:36Z",
"published": "2022-05-14T01:36:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18203"
},
{
"type": "WEB",
"url": "https://github.com/sgayou/subaru_starlink_research"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-77RJ-H8WX-6CGQ
Vulnerability from github – Published: 2026-09-16 18:32 – Updated: 2026-09-16 18:32Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
{
"affected": [],
"aliases": [
"CVE-2026-92718"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T18:17:22Z",
"severity": "HIGH"
},
"details": "Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.",
"id": "GHSA-77rj-h8wx-6cgq",
"modified": "2026-09-16T18:32:07Z",
"published": "2026-09-16T18:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92718"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei/issues/7663"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-785C-V4M5-Q4WG
Vulnerability from github – Published: 2026-08-20 21:31 – Updated: 2026-08-20 21:31The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.
{
"affected": [],
"aliases": [
"CVE-2026-72861"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T20:17:46Z",
"severity": "MODERATE"
},
"details": "The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns \"typeof signature !== \u0027string\u0027 || (await verify(...))\", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.",
"id": "GHSA-785c-v4m5-q4wg",
"modified": "2026-08-20T21:31:29Z",
"published": "2026-08-20T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72861"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/templates/issues/350"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/templates"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/templates/blob/1.1.2/node-typescript/github-issue-bot/src/github.ts"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/github.js"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/main.js"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/appwrite-templates-github-issue-bot-skips-webhook-signature-verification-when-the-x-hub-signature-256-header-is-absent"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-785H-HRF7-GQXC
Vulnerability from github – Published: 2022-05-14 03:28 – Updated: 2023-08-02 20:53In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/docker/notary"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-9258"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-02T20:53:09Z",
"nvd_published_at": "2018-03-31T21:29:00Z",
"severity": "HIGH"
},
"details": "In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.",
"id": "GHSA-785h-hrf7-gqxc",
"modified": "2023-08-02T20:53:09Z",
"published": "2022-05-14T03:28:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9258"
},
{
"type": "WEB",
"url": "https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160305015752/https://docs.docker.com/notary/changelog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Docker Notary Signature Algorithm Not Matched to Key vulnerability"
}
GHSA-786H-39X7-JGMJ
Vulnerability from github – Published: 2023-12-14 00:30 – Updated: 2024-09-20 15:30Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.
{
"affected": [],
"aliases": [
"CVE-2023-49646"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-13T23:15:08Z",
"severity": "MODERATE"
},
"details": "Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.",
"id": "GHSA-786h-39x7-jgmj",
"modified": "2024-09-20T15:30:35Z",
"published": "2023-12-14T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49646"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-23062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-796P-J2GH-9M2Q
Vulnerability from github – Published: 2026-01-26 18:55 – Updated: 2026-01-29 03:22Impact
This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl.
The library fetches QE Identity collateral (including qe_identity, qe_identity_signature, and qe_identity_issuer_chain) from the PCCS. However, it skips to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report.
Consequences
An attacker can forge the QE Identity data to whitelist a malicious or non-Intel Quoting Enclave. This allows the attacker to forge the QE and sign untrusted quotes that the verifier will accept as valid. Effectively, this bypasses the entire remote attestation security model, as the verifier can no longer trust the entity responsible for signing the quotes.
Who is impacted
All deployments utilizing the dcap-qvl library for SGX or TDX quote verification are affected.
Patches
The vulnerability has been patched in dcap-qvl version 0.3.9. The fix implements the missing cryptographic verification for the QE Identity signature and enforces the required checks for MRSIGNER, ISVPRODID, and ISVSVN against the QE Report.
Users of the @phala/dcap-qvl-node and @phala/dcap-qvl-web packages should switch to the pure JavaScript implementation, @phala/dcap-qvl.
Workarounds
There are no known workarounds for this vulnerability. Users must upgrade to the patched version to ensure that QE Identity collateral is properly verified.
Credit
This bug was reported by Rahul Saxena saxenism@bluethroatlabs.com.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "dcap-qvl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.3.0"
},
"package": {
"ecosystem": "npm",
"name": "@phala/dcap-qvl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@phala/dcap-qvl-web"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@phala/dcap-qvl-node"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "dcap-qvl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22696"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-26T18:55:13Z",
"nvd_published_at": "2026-01-26T22:15:55Z",
"severity": "CRITICAL"
},
"details": "## Impact\nThis vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl.\n\nThe library fetches QE Identity collateral (including qe_identity, qe_identity_signature, and qe_identity_issuer_chain) from the PCCS. However, it skips to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report.\n\n## Consequences\nAn attacker can forge the QE Identity data to whitelist a malicious or non-Intel Quoting Enclave. This allows the attacker to forge the QE and sign untrusted quotes that the verifier will accept as valid. Effectively, this bypasses the entire remote attestation security model, as the verifier can no longer trust the entity responsible for signing the quotes.\n\n## Who is impacted\nAll deployments utilizing the dcap-qvl library for SGX or TDX quote verification are affected.\n\n## Patches\nThe vulnerability has been patched in dcap-qvl version 0.3.9. The fix implements the missing cryptographic verification for the QE Identity signature and enforces the required checks for MRSIGNER, ISVPRODID, and ISVSVN against the QE Report.\n\nUsers of the `@phala/dcap-qvl-node` and `@phala/dcap-qvl-web` packages should switch to the pure JavaScript implementation, `@phala/dcap-qvl`.\n\n## Workarounds\nThere are no known workarounds for this vulnerability. Users must upgrade to the patched version to ensure that QE Identity collateral is properly verified.\n\n## Credit\nThis bug was reported by Rahul Saxena \u003csaxenism@bluethroatlabs.com\u003e.",
"id": "GHSA-796p-j2gh-9m2q",
"modified": "2026-01-29T03:22:29Z",
"published": "2026-01-26T18:55:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Phala-Network/dcap-qvl/security/advisories/GHSA-796p-j2gh-9m2q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22696"
},
{
"type": "PACKAGE",
"url": "https://github.com/Phala-Network/dcap-qvl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "dcap-qvl has Missing Verification for QE Identity"
}
No mitigation information available for this CWE.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.