Algorithm Confusion Vulnerability in SignXML by XML Security

CVE-2025-48994

What is CVE-2025-48994?

SignXML, a Python implementation of the W3C XML Signature standard, is susceptible to an algorithm confusion attack when verifying signatures without X509 certificate validation and with an HMAC shared secret set. In versions prior to 4.0.4, if the user does not explicitly limit expected signature algorithms, an attacker may exploit this vulnerability by supplying a signature signed with an unexpected asymmetric key instead of the provided HMAC key. From version 4.0.4 onwards, specifying the HMAC key restricts the accepted signature algorithms to HMAC only, mitigating this risk.

References