Search
Find a vulnerability
Search criteria
2 vulnerabilities found for libdigidocpp by DigiDoc
CVE-2026-103902 (GCVE-0-2026-103902)
Vulnerability from nvd – Published: 2026-10-12 10:25 – Updated: 2026-10-12 10:25
VLAI
EPSS
VEX
Title
DigiDoc improper signature verification
Summary
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures
that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.
Severity
7.5 (High)
CWE
- CWE-347 - Improper verification of cryptographic signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-eid/libdigidocpp/pull/735 | patch |
| https://www.id.ee/en/article/id-tarkvara-uus-vers… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| DigiDoc | libdigidocpp |
Affected:
4.0.0 , < 4.5.0
(semver)
|
|
| DigiDoc | DigiDoc4 |
Affected:
4.6.0 , < 4.11.0
(semver)
|
|
| DigiDoc | DigiDoc Android |
Affected:
2.7.0 , < 3.1.0
(semver)
|
|
| DigiDoc | DigiDoc iOS |
Affected:
2.7.0 , < 3.1.0
(semver)
|
Date Public
2026-10-12 10:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libdigidocpp",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "4.11.0",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc Android",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc iOS",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-12T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0."
}
],
"value": "Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T10:25:20.361Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/735"
},
{
"tags": [
"government-resource"
],
"url": "https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DigiDoc improper signature verification",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-103902",
"datePublished": "2026-10-12T10:25:20.361Z",
"dateReserved": "2026-10-01T14:12:50.876Z",
"dateUpdated": "2026-10-12T10:25:20.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103902 (GCVE-0-2026-103902)
Vulnerability from cvelistv5 – Published: 2026-10-12 10:25 – Updated: 2026-10-12 10:25
VLAI
EPSS
VEX
Title
DigiDoc improper signature verification
Summary
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures
that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.
Severity
7.5 (High)
CWE
- CWE-347 - Improper verification of cryptographic signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-eid/libdigidocpp/pull/735 | patch |
| https://www.id.ee/en/article/id-tarkvara-uus-vers… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| DigiDoc | libdigidocpp |
Affected:
4.0.0 , < 4.5.0
(semver)
|
|
| DigiDoc | DigiDoc4 |
Affected:
4.6.0 , < 4.11.0
(semver)
|
|
| DigiDoc | DigiDoc Android |
Affected:
2.7.0 , < 3.1.0
(semver)
|
|
| DigiDoc | DigiDoc iOS |
Affected:
2.7.0 , < 3.1.0
(semver)
|
Date Public
2026-10-12 10:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libdigidocpp",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "4.11.0",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc Android",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc iOS",
"vendor": "DigiDoc",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-12T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0."
}
],
"value": "Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T10:25:20.361Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/735"
},
{
"tags": [
"government-resource"
],
"url": "https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DigiDoc improper signature verification",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-103902",
"datePublished": "2026-10-12T10:25:20.361Z",
"dateReserved": "2026-10-01T14:12:50.876Z",
"dateUpdated": "2026-10-12T10:25:20.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}