CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass
Attackers can bypass signature verification to obtain signed tokens for sensitive resources, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64623?
CVE-2026-64623 is a high-severity vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC.
Weakness: CWE-347
Which versions are affected by CVE-2026-64623?
How do I fix CVE-2026-64623?
No fix has been published for CVE-2026-64623 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64623 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64623 exists.
Sources
Also known as GHSA-37v5-gpcx-w9fc, GHSA-3jf7-33vc-hgf4.