CVE-2026-103902CWE-347

CVE-2026-103902

High · published October 12, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures

that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-10-12T15:17Z
References (2)
https://github.com/open-eid/libdigidocpp/pull/735 · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/ · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 10:25Z
    DigiDoc improper signature verification
    cvelistv5
  • 12 OCT 10:25Z
    DigiDoc improper signature verification
    cvelistv5