CVE-2026-103316

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

• CWE-269

• https://apps.apple.com/us/app/digid/id1208460960

Published

Oct 13, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103297CAI Content Credentials is affected by an Improper Verificat…7.5
• CVE-2026-103304The eaSYNC Booking WordPress plugin before 1.3.31 does not …5.3
• CVE-2026-103305The Prenotazioni WordPress plugin through 1.7.5 does not hav…8.8
• CVE-2026-103307The Walletdoc Payment Gateway for WooCommerce WordPress plug…8.6
• CVE-2026-103308The Visma Pay for WooCommerce WordPress plugin before 1.2.2 …6.5
• CVE-2026-103309The GPTranslate WordPress plugin before 2.34.14 does not pr…7.5
• CVE-2026-103321MISP contains a stored cross-site script (XSS) vulnerability…8.3
• CVE-2026-103323The Integration for Epos Now and WooCommerce WordPress plugi…5.9
• CVE-2026-103324The Cardinity Payment Gateway for WooCommerce WordPress plug…5.3
• CVE-2026-103329The Super Payments WordPress plugin before 1.43.1 does not p…5.3
• CVE-2026-103334Insertion of Sensitive Information Into Sent Data vulnerabil…7.5
• CVE-2026-103335Insertion of Sensitive Information Into Sent Data vulnerabil…5.3