Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".

For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".

This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:
(1) in use-cases other than qualified certificate authentication, or
(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.

This issue was fixed in version 1.8.463.2.

CWE-295

[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir SDK","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"463","versionType":"custom","status":"affected"}]}]

[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir SDK","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.8.463.2","versionType":"semver","status":"affected"}]}]

Title: Szafir SDK de Krajowa Izba Rozliczeniowa, Description: El SDK de Szafir devuelve un código de estado de éxito del proceso de verificación de firma digital criptográfica (es decir, /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, 'Verificado positivamente') incluso cuando el estado de confianza del certificado del firmante no pudo establecerse (es decir, /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == 'nondetermined'). Esto provoca que las aplicaciones consumidoras traten incorrectamente la firma como válida a pesar de una cadena de certificados no verificada, lo que permite la omisión de autenticación y la suplantación de identidad de usuario.

Este problema se solucionó en la versión 463.

{"timestamp":"2026-05-26T15:57:55.171237Z","id":"CVE-2026-9058","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir SDK","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"463","versionType":"custom","status":"affected"}]}]

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-393

CWE-637

https://cert.pl/posts/2026/05/CVE-2026-9058

https://www.elektronicznypodpis.pl/