CVE-2026-4601: kjur jsrsasign Missing Cryptographic Step

Vulnerability summary

CVE-2026-4601 is a critical (CVSS 9.4) Missing Cryptographic Step vulnerability in kjur jsrsasign. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-03-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

• CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.