Skip to content
OpenAdvisories

Weakness (CWE)

CWE-347: Improper Verification of Cryptographic Signature

Base Draft

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Source: MITRE CWE-347

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-67276 Exploited Public exploit

    SSH user impersonation possible in Mikrotik RouterOS

    RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker …

    MikroTik RouterOS Network devices
  • Critical 10.0
    CVE-2026-5430 Exploited Public exploit EPSS 22%

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
    KEV Sep 24, 2026
  • Critical 10.0
    CVE-2026-48558 Exploited Public exploit EPSS 80%

    SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

    SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying the…

    SimpleHelp SimpleHelp
    KEV Jun 29, 2026
  • Critical 9.1
    CVE-2025-59718 Exploited Public exploit EPSS 68%

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…

    Fortinet FortiOS FortiProxy FortiSwitchManager Network devices
    KEV Dec 16, 2025
  • Medium 4.6
    CVE-2025-47827 Exploited Public exploit

    In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograp…

    KEV Oct 14, 2025
  • Critical 10.0
    CVE-2020-2021 Exploited · Ransomware Public exploit

    PAN-OS: Authentication Bypass in SAML Authentication

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…

    Palo Alto Networks PAN-OS Network devices
    KEV Mar 25, 2022
  • Medium 5.5
    CVE-2013-3900 Exploited Public exploit EPSS 45%

    WinVerifyTrust Signature Validation Vulnerability

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 10, 2022