Common Weakness Enumeration
CWE-637
Allowed-with-ReviewUnnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
Abstraction: Class · Status: Draft
The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
1 vulnerability references this CWE, most recent first.
CVE-2026-9058 (GCVE-0-2026-9058)
Vulnerability from cvelistv5 – Published: 2026-05-25 13:23 – Updated: 2026-07-23 12:00
VLAI
EPSS
VEX
Title
Improper Certificate Verification in Szafir SDK
Summary
For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".
For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".
This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:
(1) in use-cases other than qualified certificate authentication, or
(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.
This issue was fixed in version 1.8.463.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/05/CVE-2026-9058 | third-party-advisory |
| https://www.elektronicznypodpis.pl/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Krajowa Izba Rozliczeniowa | Szafir SDK |
Affected:
0 , < 1.8.463.2
(semver)
|
Date Public
2026-05-25 06:12
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:57:55.171237Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:58:01.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Szafir SDK",
"vendor": "Krajowa Izba Rozliczeniowa",
"versions": [
{
"lessThan": "1.8.463.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Leszczy\u0144ski (icedev.pl)"
}
],
"datePublic": "2026-05-25T06:12:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eFor untrusted certificates that contain the \"Authority Information Access - caIssuers URI\" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a \"nonqualified\" certificate. In such a case, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nonqualified\".\u003cbr\u003e\u003cbr\u003eFor other types of untrusted certificates, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nondetermined\".\u003cbr\u003e\u003cbr\u003eThis may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:\u003cbr\u003e(1) in use-cases other than qualified certificate authentication, or\u003cbr\u003e(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003eThis issue was fixed in version \u003cspan\u003e1.8.463.2\u003c/span\u003e."
}
],
"value": "For untrusted certificates that contain the \"Authority Information Access - caIssuers URI\" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a \"nonqualified\" certificate. In such a case, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nonqualified\".\n\nFor other types of untrusted certificates, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nondetermined\".\n\nThis may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:\n(1) in use-cases other than qualified certificate authentication, or\n(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.\n\nThis issue was fixed in version 1.8.463.2."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-637",
"description": "CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using \u0027Economy of Mechanism\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-393",
"description": "CWE-393: Return of Wrong Status Code",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T12:00:31.927Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/05/CVE-2026-9058"
},
{
"tags": [
"product"
],
"url": "https://www.elektronicznypodpis.pl/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Certificate Verification in Szafir SDK",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-9058",
"datePublished": "2026-05-25T13:23:09.157Z",
"dateReserved": "2026-05-20T06:36:10.929Z",
"dateUpdated": "2026-07-23T12:00:31.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Avoid complex security mechanisms when simpler ones would meet requirements. Avoid complex data models, and unnecessarily complex operations. Adopt architectures that provide guarantees, simplify understanding through elegance and abstraction, and that can be implemented similarly. Modularize, isolate and do not trust complex code, and apply other secure programming principles on these modules (e.g., least privilege) to mitigate vulnerabilities.
No CAPEC attack patterns related to this CWE.