CVE-2026-4601 - Vulnerability Analysis

Overview

jsrsasign < 11.1.1 contains a missing cryptographic step caused by improper handling of zero values in DSA signing implementation, letting attackers recover private keys by forcing r or s to zero, exploit requires crafted signature inputs.

Severity & Score

Impact

Attackers can recover private keys, compromising cryptographic security and enabling signature forgery.

Mitigation

Update to version 11.1.1 or later.

References

• https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586
• https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb
• https://github.com/kjur/jsrsasign/pull/645
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 23, 2026

🛡️ CVE-2026-4601: CRITICAL bug in jsrsasign <11.1.1 misses a vital DSA signing step, letting attackers recover private keys if exploited. No active attacks yet, but update ASAP! Details: https://radar.offseq.com/threat/cve-2026-4601-missing-cryptographic-step-in-jsrsas-1b19c447 #OffSeq #CVE20264601 #Crypto #Vuln

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner