Vulnerabilities & Exploits · Credential Theft

Szafir SDK Trusted Bad Signatures as Verified

The break is in trust, not just signature math. Szafir SDK can return a clean verification result even when it cannot prove the signer’s certificate is trusted, so applications that rely on that result may accept an identity they never actually validated.

CERT Polska says this is CVE-2026-9058 in Szafir SDK, and it was fixed in version 463. The failure affects applications that embed or consume the SDK for signature verification or authentication, because a normal-looking "verified" result can mask an unresolved certificate chain and enable authentication bypass or user impersonation.

1 source · May 25

Timeline

• May 25 Reported by CERT Polska

Sources

• May 25 CERT Polska

  Vulnerability in Szafir SDK software

  Improper Certificate Verification vulnerability (CVE-2026-9058) has been found in Szafir SDK software.

  original

Part of the PlainSec briefing for 2026-05-25

Every edition of this story: Szafir SDK Trusted Bad Signatures as Verified

More from today

• Ghost SQLi Turns Sites Into Trusted Malware Launchpads
• Trusted Package Channels Became the Attack Vector
• Shared MachineKey Turns One LMS Bug Into Fleet Risk