CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.

• CWE-303

• https://github.com/XML-Security/signxml/commit/e3c0c2b82a3329a65d917830657649c98b8c7600
• https://github.com/XML-Security/signxml/security/advisories/GHSA-6vx8-pcwv-xhf4

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48989Improper Resource Shutdown or Release vulnerability in Apach…7.5
• CVE-2025-4899A vulnerability was found in Campcodes Sales and Inventory S…9.8
• CVE-2025-48990NeKernal is a free and open-source operating system stack. V…8.6
• CVE-2025-48991Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-48992Group-Office is an enterprise customer relationship manageme…4.8
• CVE-2025-48993Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2025-48995SignXML is an implementation of the W3C XML Signature standa…6.9
• CVE-2025-48996HAX open-apis provides microservice apis for HAX webcomponen…5.3
• CVE-2025-48997Multer is a node.js middleware for handling `multipart/form-…8.7
• CVE-2025-48998DataEase is an open source business intelligence and data vi…8.8
• CVE-2025-48999DataEase is an open source business intelligence and data vi…8.8
• CVE-2025-4900A vulnerability classified as critical has been found in Cam…9.8