CVE-2025-48994: SignXML Algorithm Confusion Vulnerability

CVE-2025-48994 Overview

SignXML is a Python implementation of the W3C XML Signature standard. Versions prior to 4.0.4 contain an algorithm confusion vulnerability affecting signature verification. The flaw appears when callers invoke signxml.XMLVerifier.verify() with require_x509=False and an hmac_key value set. In this configuration, SignXML does not restrict the accepted signature algorithms to HMAC. An attacker can supply an XML document signed with an asymmetric algorithm and a key of their choosing, and the verifier accepts it as valid. The issue is tracked as [CWE-303: Incorrect Implementation of Authentication Algorithm].

Critical Impact
Attackers can bypass HMAC-based signature verification by submitting XML documents signed with an unrelated asymmetric key, undermining message authenticity guarantees.

Affected Products

SignXML Python library versions prior to 4.0.4
Applications invoking XMLVerifier.verify(require_x509=False, hmac_key=...) without an explicit expect_config
Downstream systems relying on SignXML for XML signature authentication

Discovery Timeline

2025-06-02 - CVE-2025-48994 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48994

Vulnerability Analysis

SignXML permits callers to verify XML signatures using a shared HMAC secret when X.509 certificate validation is disabled. The verifier was designed to accept any signature algorithm advertised in the incoming XML unless the caller supplied an expect_config restriction. This design allowed algorithm confusion between symmetric HMAC and asymmetric signature primitives such as RSA or ECDSA.

An attacker who controls the signed XML payload can craft a document whose SignatureMethod element references an asymmetric algorithm and embeds a public key of the attacker's choosing. The verifier processes that algorithm path instead of validating against the configured HMAC secret. The signature check succeeds even though the sender never possessed the shared secret. The result is a full authentication bypass for consumers that assumed an hmac_key argument was sufficient to enforce HMAC-only verification.

Root Cause

The root cause is missing enforcement of the intended verification algorithm class. Passing hmac_key expressed caller intent to verify HMAC signatures, but the verifier did not derive that constraint automatically. Starting with SignXML 4.0.4, supplying hmac_key restricts the accepted algorithms to HMAC when the caller has not already narrowed them through expect_config.

Attack Vector

Exploitation requires the target application to expose a code path that calls XMLVerifier.verify() with require_x509=False and an hmac_key, and to accept externally supplied XML. The attacker crafts an XML document signed with an asymmetric algorithm and embeds their own key material in the KeyInfo element. The verifier evaluates the asymmetric signature and returns success, allowing the attacker to forge authenticated XML messages. See the GitHub Security Advisory GHSA-6vx8-pcwv-xhf4 and the remediation commit for technical details.

Detection Methods for CVE-2025-48994

Indicators of Compromise

XML signature payloads whose SignatureMethod algorithm URI references RSA, ECDSA, or DSA while the receiving service is configured for HMAC verification
KeyInfo elements containing unexpected X509Certificate or KeyValue data on endpoints that should rely only on a preshared HMAC secret
Successful signature verification events originating from senders that never provisioned an HMAC secret with the application

Detection Strategies

Perform static analysis of application code to enumerate all calls to signxml.XMLVerifier.verify() and flag those combining require_x509=False with hmac_key and no expect_config
Instrument the SignXML verification path to log the resolved signature algorithm and compare it against the algorithm class expected by the business logic
Inventory SignXML package versions across build artifacts and containers using software composition analysis to identify installs below 4.0.4

Monitoring Recommendations

Alert on application logs that record signature verifications where the algorithm URI does not match http://www.w3.org/2000/09/xmldsig#hmac-*
Track deployment of SignXML upgrades across services and fail builds that pin vulnerable versions
Correlate authentication anomalies with inbound XML signature metadata to identify probing attempts against affected endpoints

How to Mitigate CVE-2025-48994

Immediate Actions Required

Upgrade SignXML to version 4.0.4 or later in all applications and container images
Audit every call site that uses XMLVerifier.verify() and add an explicit expect_config restricting the accepted signature algorithms
Rotate any HMAC secrets that may have been exposed to systems processing untrusted XML during the vulnerable window

Patch Information

The fix is included in SignXML 4.0.4. When hmac_key is supplied and the caller has not already restricted algorithms through expect_config, the verifier now limits the accepted signature algorithm set to HMAC variants only. The change is implemented in the SignXML remediation commit.

Workarounds

Pass an explicit expect_config argument to XMLVerifier.verify() that restricts signature_algorithms to the HMAC variants your application expects
Reject XML documents whose SignatureMethod algorithm URI does not match an allowlist before invoking SignXML verification
Where feasible, enable require_x509=True and validate signatures against a trusted certificate chain instead of a shared HMAC secret

bash

# Upgrade SignXML to the patched release
pip install --upgrade 'signxml>=4.0.4'

# Verify the installed version
python -c "import signxml; print(signxml.__version__)"