Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-16027 EUVD-2026-54397GHSA-jxrw-hc36-36pw

Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature

Published Aug 7, 2026 · Updated Aug 7, 2026 · Assigned by TR-CERT

Vendor: Revenue Administration Product: E-Signature

Description

Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery.

This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0.

Affected products

VendorProductAffectedFixed
Revenue Administration E-Signature 2.4.4.0 – < 2.5.1.0 2.5.1.0

References