CVE-2026-106036EUVD-2026-113121
Improper certificate validation in Szafir
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in build 708
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Szafir, a Polish electronic signature application, is affected by this flaw. Because it does not verify server certificates or hostnames, an attacker on the network path or controlling a server could impersonate the update server and deliver a malicious update file to the user's computer.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Krajowa Izba Rozliczeniowa Szafir
fixed in build 708