Krajowa Izba Rozliczeniowa Szafir SDK Authentication Bypass Vulnerability via Improper Digital Signature Verification

A vulnerability in Szafir SDK allows for authentication bypass and user impersonation by incorrectly validating digital signatures. The SDK returns a success status code for signature verification even when the trust status of the signer's certificate is undetermined. This flaw enables applications using Szafir SDK to accept signatures as valid without a verified certificate chain. The issue affects all versions of Szafir SDK prior to 463.

Impact

Exploitation of this vulnerability allows for authentication bypass and user impersonation in applications using Szafir SDK.

Remediation

Users can upgrade to Szafir SDK version 463 or later to address this vulnerability.