CVE-2026-4600: Jsrsasign Auth Bypass Vulnerability

CVE-2026-4600 Overview

CVE-2026-4600 is a critical cryptographic signature verification vulnerability affecting the jsrsasign JavaScript library. Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic and the related DSA/X509 verification flow in src/dsa-2.0.js. An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Critical Impact

Attackers can forge DSA signatures and X.509 certificates, completely bypassing cryptographic verification and potentially compromising authentication, code signing, and certificate validation workflows.

Affected Products

• jsrsasign versions prior to 11.1.1
• Node.js applications using vulnerable jsrsasign versions
• Web applications implementing DSA or X.509 verification with jsrsasign

Discovery Timeline

• 2026-03-23 - CVE-2026-4600 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4600

Vulnerability Analysis

This vulnerability stems from insufficient validation of DSA domain parameters in the jsrsasign cryptographic library. The Digital Signature Algorithm (DSA) relies on specific mathematical relationships between its domain parameters (p, q, g) and the public key (y) to ensure signature integrity. When these parameters are not properly validated, an attacker can craft malicious values that trivially satisfy the signature verification equation regardless of the actual message hash.

The flaw exists in the KJUR.crypto.DSA.setPublic function and the DSA/X509 verification flow within src/dsa-2.0.js. By supplying specially crafted domain parameters such as g=1, y=1, and r=1, an attacker can force the verification equation to evaluate to true for any arbitrary hash value, enabling complete signature forgery.

Root Cause

The root cause is the absence of FIPS 186-4 Section 4.7 compliant domain parameter validation when setting DSA public keys. According to FIPS 186-4, domain parameters and public keys shall be validated to ensure they fall within acceptable ranges and maintain the required mathematical properties. The vulnerable code accepted any domain parameters without verifying:

1. That q and g are greater than 1 and less than p
2. That y is greater than 1 and less than p
3. That g raised to the power q modulo p equals 1 (proving g has order q in the multiplicative group)

Attack Vector

The attack is network-based and requires no user interaction or special privileges. An attacker can exploit this vulnerability by:

1. Creating a malicious X.509 certificate or DSA signature with crafted domain parameters
2. Setting g=1 and y=1 in the public key parameters
3. Using r=1 as part of the signature, which makes the verification equation trivially true
4. Submitting the forged certificate or signature to any application using vulnerable jsrsasign versions

The following patch demonstrates the security fix that adds proper domain parameter validation:

         _getVbyList = _ASN1HEX.getVbyList,
         _getVbyListEx = _ASN1HEX.getVbyListEx,
 	_isASN1HEX = _ASN1HEX.isASN1HEX,
-	_BigInteger = BigInteger;
+	_BigInteger = BigInteger,
+	_BI_ONE = BigInteger.ONE;
+
+    var _validatePublicArgs = function(p, q, g, y) {
+	if (p == null || q == null || g == null || y == null)
+	    throw new Error("invalid DSA public key");
+
+	// FIPS 186-4 4.7: domain parameters and public key shall be validated.
+	if (_BI_ONE.compareTo(q) >= 0 || q.compareTo(p) >= 0)
+	    throw new Error("invalid DSA public key");
+	if (_BI_ONE.compareTo(g) >= 0 || g.compareTo(p) >= 0)
+	    throw new Error("invalid DSA public key");
+	if (_BI_ONE.compareTo(y) >= 0 || y.compareTo(p) >= 0)
+	    throw new Error("invalid DSA public key");
+	if (g.modPow(q, p).compareTo(_BI_ONE) != 0)
+	    throw new Error("invalid DSA public key");
+    };
+
     this.p = null;
     this.q = null;
     this.g = null;

Source: GitHub Commit Changes

Detection Methods for CVE-2026-4600

Indicators of Compromise

• X.509 certificates with DSA public keys containing domain parameters where g=1 or y=1
• DSA signatures where the r component equals 1
• Certificate validation logs showing acceptance of certificates with malformed DSA parameters
• Unexpected authentication successes for DSA-signed credentials

Detection Strategies

• Implement software composition analysis (SCA) to identify jsrsasign versions below 11.1.1 in your codebase and dependencies
• Monitor certificate validation operations for DSA certificates with suspicious domain parameter values
• Use dependency scanning tools to detect vulnerable npm packages in Node.js applications
• Review application logs for anomalous certificate or signature verification patterns

Monitoring Recommendations

• Enable verbose logging for X.509 certificate verification operations in applications using jsrsasign
• Implement alerting for any DSA signature verification operations until patching is complete
• Monitor npm audit reports and security advisories for jsrsasign-dependent applications
• Track package versions across development, staging, and production environments

How to Mitigate CVE-2026-4600

Immediate Actions Required

• Upgrade jsrsasign to version 11.1.1 or later immediately
• Audit all applications and dependencies that use jsrsasign for DSA signature or X.509 certificate verification
• Review any certificates or signatures verified by vulnerable versions for potential forgery
• Temporarily disable DSA-based signature verification if immediate patching is not possible

Patch Information

The vulnerability is fixed in jsrsasign version 11.1.1. The patch adds a _validatePublicArgs function that enforces FIPS 186-4 Section 4.7 compliant validation of DSA domain parameters and public keys. The fix ensures that:

• Parameters p, q, g, and y are not null
• q is greater than 1 and less than p
• g is greater than 1 and less than p
• y is greater than 1 and less than p
• g^q mod p equals 1

For detailed patch information, see the GitHub Pull Request Discussion and the GitHub Commit Changes.

Workarounds

• If immediate upgrade is not possible, implement application-layer validation of DSA domain parameters before passing to jsrsasign
• Consider switching to alternative cryptographic algorithms (RSA, ECDSA) that are not affected by this specific vulnerability
• Implement certificate pinning to restrict accepted certificates to known-good issuers
• Deploy web application firewalls (WAF) rules to detect and block requests containing malformed DSA parameters

# Upgrade jsrsasign to patched version
npm update jsrsasign@11.1.1

# Verify installed version
npm list jsrsasign

# Audit for vulnerabilities
npm audit