Executive brief
The Szafir SDK, a software toolkit used for processing digital signatures, contains a flaw where it incorrectly reports a signature as valid even if the signer's identity cannot be verified. This allows an attacker to bypass security checks by using unverified or untrusted certificates. In practice, this could lead to unauthorized access to systems or the ability for an attacker to impersonate legitimate users in digital transactions.
Technical details
A vulnerability exists in the Szafir SDK's cryptographic verification process where the system returns a success code (/VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0) despite the certificate type being flagged as 'nondetermined'. This root cause is a failure to properly validate the certificate chain's trust status before confirming signature validity. An unauthenticated remote attacker can exploit this by providing a signature with an unverified certificate, which consuming applications will treat as valid. This enables authentication bypass and user impersonation. The issue is addressed in version 463.
Affected products
- Krajowa Izba Rozliczeniowa (KIR) Szafir SDK All versions prior to 463
Timeline
- 2026-05-25: advisory: Advisory published by CERT.PL and NVD
- 2026-05-25: patched: Vulnerability fixed in version 463