CVE-2026-103902

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/open-eid/libdigidocpp/pull/735
https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/

Configurations

No configuration.

History

12 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-12 11:17

Updated : 2026-10-16 20:04

NVD link : CVE-2026-103902

Mitre link : CVE-2026-103902

CVE.ORG link : CVE-2026-103902

JSON object : View

Products Affected

No product.

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-103902", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103902", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:00:40.710010Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "affectedData": [{"vendor": "DigiDoc", "product": "libdigidocpp", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "DigiDoc", "product": "DigiDoc4", "versions": [{"status": "affected", "version": "4.6.0", "lessThan": "4.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "DigiDoc", "product": "DigiDoc Android", "versions": [{"status": "affected", "version": "2.7.0", "lessThan": "3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "DigiDoc", "product": "DigiDoc iOS", "versions": [{"status": "affected", "version": "2.7.0", "lessThan": "3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-12T11:17:08.617", "references": [{"url": "https://github.com/open-eid/libdigidocpp/pull/735", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0."}], "lastModified": "2026-10-16T20:04:29.760", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}