Report an incident
Back
  • About us
  • For experts
Report an incident
About us
About our team Contact
Baza wiedzy
Fałszywe inwestycje Uważaj na fałszywe sklepy online (Nie)bezpieczne płatności Fałszywi konsultanci Zadbaj o bezpieczne hasła i logowanie Fałszywe załączniki w mailach Fałszywe prośby o szybki przelew Fałszywe SMSy - plaga ostatnich miesięcy Bezpieczny telefon
Biuletyn OUCH!
Porady bezpieczeństwa OUCH!
Tools
n6 Artemis MWDB
CVD program
CVD policy Advisories

Vulnerability in Szafir SDK software
25 May 2026 | CERT Polska | #vulnerability, #warning, #cve
CVE ID CVE-2026-9058
Publication date 25 May 2026
Vendor Krajowa Izba Rozliczeniowa
Product Szafir SDK
Vulnerable versions All before 463
Vulnerability type (CWE) Return of Wrong Status Code (CWE-393)
Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') (CWE-637)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerability in Szafir SDK software and participated in coordination of its disclosure.

The vulnerability CVE-2026-9058: Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

Credits

We thank Michał Leszczyński (icedev.pl) for the responsible vulnerability report.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.