CVE-2026-9058 Improper Certificate Verification in Szafir SDK
Szafir SDK incorrectly verifies untrusted certificates, allowing attackers to bypass authentication and impersonate users in integrating applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9058?
CVE-2026-9058 is a critical authentication bypass vulnerability in Krajowa Izba Rozliczeniowa Szafir SDK, published on 25 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".
For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".
This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.
This issue was fixed in version 1.8.463.2.
Which versions are affected by CVE-2026-9058?
How do I fix CVE-2026-9058?
No fix has been published for CVE-2026-9058 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-9058 being exploited?
There is no known exploitation of CVE-2026-9058 in the wild and no public exploit code.
Sources
Also known as GHSA-7hq7-5m7p-r2pp.