CWE-347 Improper Verification of Cryptographic Signature

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

python-jose algorithm confusion guard bypassed by DER-encoded public keys

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT accepts public JWK containers as HMAC secrets

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

PyJWT BOM Bypass

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

AIIR verification and policy gates could report success without enforcing the control (fail-open)

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

node-opcua missing nonce verification in UserNameIdentityToken authentication

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

Django: signed cookies are vulnerable to salt namespace collisions

Keycloak has an Improper Verification of Cryptographic Signature issue