CVE-2026-5466

wolfSSL's ECCSI signature verifier wcVerifyEccsiHash decodes the r and s scalars from the signature blob via mpreadunsignedbin with no check that they lie in 1, q-1. A crafted forged signature could verify against any message for any identity, using only publicly-known constants...

CVE-2026-5466

creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70 2026-09-02 06:00:17+00:00| seen| https://t.me/RussianOSINT/7197 2026-09-03 00:00:44+00:00| seen| https://t.me/RussianOSINT/7197...