CWE-347
AllowedImproper Verification of Cryptographic Signature
Abstraction: Base · Status: Draft
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
1387 vulnerabilities reference this CWE, most recent first.
GHSA-MW3H-QJXJ-6XG9
Vulnerability from github – Published: 2026-07-31 18:51 – Updated: 2026-07-31 18:51HMAC validation bypass via multiple .replace() calls when removing URL signature
Summary
Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.
This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.
Details
Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.
During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:
url_signature = self.context.request.hash
if url_signature:
signer = self.context.modules.url_signer(
self.context.server.security_key
)
try:
quoted_hash = quote(self.context.request.hash)
except KeyError:
self._error(400, f"Invalid hash: {self.context.request.hash}")
return
url_to_validate = url.replace(
f"/{self.context.request.hash}/", ""
).replace(f"/{quoted_hash}/", "")
valid = signer.validate(
unquote(url_signature).encode(), url_to_validate
)
The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.
Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.
Example
Valid request:
/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg
By injecting the same hash inside the URL:
/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg
After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.
Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.
Example:
/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...
Impact
This behavior may allow attackers to:
- Bypass HMAC URL validation
- Load images from arbitrary domains
- Abuse Thumbor deployments as an open proxy / image fetcher
- Circumvent domain restrictions intended by the signed URL mechanism
Root Cause
Use of .replace() without limiting the number of replacements when removing the signature from the URL.
Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.
Suggested Fix
Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.
Example:
url.replace(f"/{self.context.request.hash}/", "", 1)
Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.7.7"
},
"package": {
"ecosystem": "PyPI",
"name": "thumbor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53501"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T18:51:54Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# HMAC validation bypass via multiple `.replace()` calls when removing URL signature\n\n## Summary\n\nThumbor\u2019s HMAC validation can be bypassed due to the use of Python\u2019s `.replace()` when removing the signature from the URL before validation. Since `.replace()` removes **all occurrences** of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.\n\nThis allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.\n\n## Details\n\nThumbor signs URLs using **HMAC-SHA1** to prevent abuse such as loading arbitrary external images or invoking filters without authorization.\n\nDuring request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:\n\n```python\nurl_signature = self.context.request.hash\nif url_signature:\n signer = self.context.modules.url_signer(\n self.context.server.security_key\n )\n\n try:\n quoted_hash = quote(self.context.request.hash)\n except KeyError:\n self._error(400, f\"Invalid hash: {self.context.request.hash}\")\n return\n\n url_to_validate = url.replace(\n f\"/{self.context.request.hash}/\", \"\"\n ).replace(f\"/{quoted_hash}/\", \"\")\n\n valid = signer.validate(\n unquote(url_signature).encode(), url_to_validate\n )\n```\n\nThe issue is that `.replace()` removes **every occurrence** of the substring in the URL, not just the first one.\n\nBecause the signature itself appears in the URL, an attacker can **inject additional copies of the signature** elsewhere in the path. When Thumbor performs `.replace()`, these extra occurrences are also removed, resulting in a different `url_to_validate` than the original request.\n\n## Example\n\nValid request:\n\n```\n/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg\n```\n\nBy injecting the same hash inside the URL:\n\n```\n/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg\n```\n\nAfter `.replace()` removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.\n\nFurther manipulation is possible due to the **second `.replace()` for the URL-encoded hash (`%3D`)**, enabling more precise path manipulation.\n\nExample:\n\n```\n/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...\n```\n\n## Impact\n\nThis behavior may allow attackers to:\n\n- Bypass HMAC URL validation\n- Load images from arbitrary domains\n- Abuse Thumbor deployments as an open proxy / image fetcher\n- Circumvent domain restrictions intended by the signed URL mechanism\n\n## Root Cause\n\nUse of `.replace()` without limiting the number of replacements when removing the signature from the URL.\n\nSince the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.\n\n## Suggested Fix\n\nRemove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.\n\nExample:\n\n```python\nurl.replace(f\"/{self.context.request.hash}/\", \"\", 1)\n```\n\nAlternatively, reconstruct the unsigned URL deterministically from the parsed request components.",
"id": "GHSA-mw3h-qjxj-6xg9",
"modified": "2026-07-31T18:51:54Z",
"published": "2026-07-31T18:51:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9"
},
{
"type": "WEB",
"url": "https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b"
},
{
"type": "PACKAGE",
"url": "https://github.com/thumbor/thumbor"
},
{
"type": "WEB",
"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature"
}
GHSA-MW9F-F52P-CHPP
Vulnerability from github – Published: 2025-08-01 06:31 – Updated: 2025-08-01 15:34It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.
{
"affected": [],
"aliases": [
"CVE-2025-8454"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T06:15:29Z",
"severity": "CRITICAL"
},
"details": "It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.",
"id": "GHSA-mw9f-f52p-chpp",
"modified": "2025-08-01T15:34:17Z",
"published": "2025-08-01T06:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8454"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/1109251"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MWFC-GQVV-7HQ8
Vulnerability from github – Published: 2022-04-15 00:00 – Updated: 2022-04-22 00:00An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.
{
"affected": [],
"aliases": [
"CVE-2020-25166"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-14T21:15:00Z",
"severity": "HIGH"
},
"details": "An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.",
"id": "GHSA-mwfc-gqvv-7hq8",
"modified": "2022-04-22T00:00:46Z",
"published": "2022-04-15T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25166"
},
{
"type": "WEB",
"url": "https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MWHF-VHR5-7J23
Vulnerability from github – Published: 2024-09-12 21:29 – Updated: 2024-09-12 21:39Impact
Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.
Patches
Patched in version 4.0.3.
Workarounds
It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.
function doPost(payload, header_signature) {
if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {
throw 403;
}
// Now the payload is correctly verified
whatsapp.post(payload);
}
References
https://github.com/Secreto31126/whatsapp-api-js/pull/371
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "whatsapp-api-js"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-45607"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T21:29:17Z",
"nvd_published_at": "2024-09-12T20:15:05Z",
"severity": "MODERATE"
},
"details": "### Impact\nIncorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.\n\n### Patches\nPatched in version 4.0.3.\n\n### Workarounds\nIt\u0027s possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.\n\n```ts\nfunction doPost(payload, header_signature) {\n if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {\n throw 403;\n }\n \n // Now the payload is correctly verified\n whatsapp.post(payload);\n}\n```\n\n### References\nhttps://github.com/Secreto31126/whatsapp-api-js/pull/371\n\n",
"id": "GHSA-mwhf-vhr5-7j23",
"modified": "2024-09-12T21:39:35Z",
"published": "2024-09-12T21:29:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45607"
},
{
"type": "WEB",
"url": "https://github.com/Secreto31126/whatsapp-api-js/pull/371"
},
{
"type": "WEB",
"url": "https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d"
},
{
"type": "PACKAGE",
"url": "https://github.com/Secreto31126/whatsapp-api-js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "whatsapp-api-js fails to validate message\u0027s signature"
}
GHSA-MX47-H5FV-GHWH
Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2023-11-01 05:52light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.networknt:light-oauth2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-31580"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-27T19:12:00Z",
"nvd_published_at": "2023-10-25T18:17:27Z",
"severity": "MODERATE"
},
"details": "light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.",
"id": "GHSA-mx47-h5fv-ghwh",
"modified": "2023-11-01T05:52:23Z",
"published": "2023-10-25T18:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31580"
},
{
"type": "WEB",
"url": "https://github.com/networknt/light-oauth2/issues/369"
},
{
"type": "WEB",
"url": "https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/networknt/light-oauth2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "light-oauth2 missing public key verification"
}
GHSA-MX9V-6QG3-92RP
Vulnerability from github – Published: 2021-12-14 00:00 – Updated: 2025-11-04 00:30CPAN 2.28 allows Signature Verification Bypass.
{
"affected": [],
"aliases": [
"CVE-2020-16156"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-13T18:15:00Z",
"severity": "HIGH"
},
"details": "CPAN 2.28 allows Signature Verification Bypass.",
"id": "GHSA-mx9v-6qg3-92rp",
"modified": "2025-11-04T00:30:30Z",
"published": "2021-12-14T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16156"
},
{
"type": "WEB",
"url": "https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC"
},
{
"type": "WEB",
"url": "https://metacpan.org/pod/distribution/CPAN/scripts/cpan"
},
{
"type": "WEB",
"url": "http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MXRG-RHMF-2MJF
Vulnerability from github – Published: 2026-01-28 21:31 – Updated: 2026-03-09 15:30Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.
{
"affected": [],
"aliases": [
"CVE-2026-0750"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-28T19:16:24Z",
"severity": "HIGH"
},
"details": "Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.",
"id": "GHSA-mxrg-rhmf-2mjf",
"modified": "2026-03-09T15:30:32Z",
"published": "2026-01-28T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0750"
},
{
"type": "WEB",
"url": "https://d7es.tag1.com/security-advisories/commerce-paybox-moderately-critical-payment-bypass-vulnerability"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-0750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MXXR-2FVG-XW43
Vulnerability from github – Published: 2025-04-23 18:30 – Updated: 2025-04-23 18:30CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the handling of update packages provided to update.cgi. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24355.
{
"affected": [],
"aliases": [
"CVE-2025-2764"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-23T17:16:54Z",
"severity": "HIGH"
},
"details": "CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the handling of update packages provided to update.cgi. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24355.",
"id": "GHSA-mxxr-2fvg-xw43",
"modified": "2025-04-23T18:30:59Z",
"published": "2025-04-23T18:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2764"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-178"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P25C-R659-95HM
Vulnerability from github – Published: 2024-09-25 12:30 – Updated: 2024-09-25 12:30Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers.
{
"affected": [],
"aliases": [
"CVE-2024-7479"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-25T11:15:12Z",
"severity": "HIGH"
},
"details": "Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers.",
"id": "GHSA-p25c-r659-95hm",
"modified": "2024-09-25T12:30:40Z",
"published": "2024-09-25T12:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7479"
},
{
"type": "WEB",
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P2WF-CWQ4-F5GJ
Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 00:31Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
{
"affected": [],
"aliases": [
"CVE-2026-62918"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T00:16:36Z",
"severity": "HIGH"
},
"details": "Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.",
"id": "GHSA-p2wf-cwq4-f5gj",
"modified": "2026-08-07T00:31:23Z",
"published": "2026-08-07T00:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62918"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62918"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.