# CVE-2026-9058: KIR Szafir SDK authentication bypass via improper signature verification

Source: https://junglewise.ai/threats/cve-2026-9058-kir-szafir-sdk-authentication-bypass-via-improper-signature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9058 · Severity: info · CVSS 9.3 · Published 2026-05-25

The Szafir SDK, a software toolkit used for processing digital signatures, contains a flaw where it incorrectly reports a signature as valid even if the signer's identity cannot be verified. This allows an attacker to bypass security checks by using unverified or untrusted certificates. In practice, this could lead to unauthorized access to systems or the ability for an attacker to impersonate legitimate users in digital transactions.

Vendors: [Krajowa Izba Rozliczeniowa](https://junglewise.ai/threats/vendors/krajowa-izba-rozliczeniowa).

## Quick answers

**Is CVE-2026-9058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9058 being exploited in the wild.

**How severe is CVE-2026-9058?** Informational severity, with a CVSS score of 9.3, published 25 May 2026.

**Which products and versions are affected?** Krajowa Izba Rozliczeniowa Szafir SDK All versions prior to 463.

**Is there a fix for CVE-2026-9058?** A patch was published on 2026-05-25: Vulnerability fixed in version 463 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9058 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9058?** Check whether you run Krajowa Izba Rozliczeniowa Szafir SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Szafir SDK's cryptographic verification process where the system returns a success code (/VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0) despite the certificate type being flagged as 'nondetermined'. This root cause is a failure to properly validate the certificate chain's trust status before confirming signature validity. An unauthenticated remote attacker can exploit this by providing a signature with an unverified certificate, which consuming applications will treat as valid. This enables authentication bypass and user impersonation. The issue is addressed in version 463.

## Affected products

- Krajowa Izba Rozliczeniowa (KIR) Szafir SDK All versions prior to 463

## Timeline

- 2026-05-25: advisory: Advisory published by CERT.PL and NVD
- 2026-05-25: patched: Vulnerability fixed in version 463

## References

- [https://cert.pl/posts/2026/05/CVE-2026-9058](https://cert.pl/posts/2026/05/CVE-2026-9058)
- [https://www.elektronicznypodpis.pl/](https://www.elektronicznypodpis.pl/)