CVE Explorer
CVE-2026-23965
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto prior to version 0.4.0. Under default configurations, an attacker can forge valid signatures for arbitrary public keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the message associated with the forged signature to satisfy specific formatting requirements.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"sm-crypto","vendor":"JuneAndGreen","versions":[{"status":"affected","version":"< 0.4.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:460703646e5fe421b44a5196704c318f0df2e18089b8ba813825065df489a8be · sha256:10da2d354588dc2f… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:460703646e5fe421b44a5196704c318f0df2e18089b8ba813825065df489a8be · sha256:10da2d354588dc2f… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:460703646e5fe421b44a5196704c318f0df2e18089b8ba813825065df489a8be · sha256:10da2d354588dc2f… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/JuneAndGreen/sm-crypto/commit/85295a859d0766222d12ce2be3e6fce7b438b510","tags":["x_refsource_MISC"],"url":"https://github.com/JuneAndGreen/sm-crypto/commit/85295a859d0766222d12ce2be3e6fce7b438b510"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:460703646e5fe421b44a5196704c318f0df2e18089b8ba813825065df489a8be · sha256:10da2d354588dc2f… · /containers/cna/references/1
{"name":"https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m","tags":["x_refsource_CONFIRM"],"url":"https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:460703646e5fe421b44a5196704c318f0df2e18089b8ba813825065df489a8be · sha256:10da2d354588dc2f… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.