Authentication Bypass Vulnerability in Szafir SDK by Elekroniczny Podpis
CVE-2026-9058

9.3CRITICAL

Key Information:

Vendor

Krajowa Izba Rozliczeniowa

Status
Szafir Sdk
Vendor
CVE Published:
25 May 2026

What is CVE-2026-9058?

The Szafir SDK contains a significant vulnerability where it improperly returns a success status code during the cryptographic digital signature verification process, even when the signer's certificate trust status remains undetermined. This flaw allows applications utilizing Szafir SDK to mistakenly accept invalid digital signatures, leading to potential authentication bypass and unauthorized user impersonation.

Affected Version(s)

Szafir SDK 0 < 463

References

https://cert.pl/posts/2026/05/CVE-2026-9058
third-party-advisory
https://www.elektronicznypodpis.pl/
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Leszczyński (icedev.pl)
.