CVE-2026-9058

🗓️ 25 May 2026 13:23:09Reported by CERT-PLType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

CVE-2026-9058 Szafir SDK returns success for unverified certificates, enabling impersonation.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-9058	25 May 202613:23	–	attackerkb
Circl	CVE-2026-9058	25 May 202607:55	–	circl
CNNVD	Krajowa Izba Rozliczeniowa Szafir SDK 安全漏洞	25 May 202600:00	–	cnnvd
Cvelist	CVE-2026-9058 Improper Certificate Verification in Szafir SDK	25 May 202613:23	–	cvelist
EUVD	EUVD-2026-31679	25 May 202613:23	–	euvd
NVD	CVE-2026-9058	25 May 202614:16	–	nvd
Positive Technologies	PT-2026-43045	25 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-9058	26 May 202620:14	–	redhatcve
Vulnrichment	CVE-2026-9058 Improper Certificate Verification in Szafir SDK	25 May 202613:23	–	vulnrichment

Vulners

Node

krajowa szafir_sdkRange<463

[
  {
    "defaultStatus": "unaffected",
    "product": "Szafir SDK",
    "vendor": "Krajowa Izba Rozliczeniowa",
    "versions": [
      {
        "lessThan": "463",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
elektronicznypodpis	www.elektronicznypodpis.pl/
cert	www.cert.pl/posts/2026/05/CVE-2026-9058

Parameter	Position	Path	Description	CWE
VerifyingTaskItem/Signature/VerificationResult/Result/@code	path	/VerifyingTaskItem/Signature/VerificationResult/Result/@code	Szafir SDK may return a success verification result even when the signer certificate trust is undetermined, enabling authentication bypass for unverified certificates.	CWE-393, CWE-637
VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType	path	/VerifyingTaskItem/Signature/VerificationResult/Result/@code	Szafir SDK may return a success verification result even when the signer certificate trust is undetermined, enabling authentication bypass for unverified certificates.	CWE-393, CWE-637

17 Jun 2026 11:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 49.3

EPSS0.00307

SSVC