CVE-2026-23967

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

• CWE-347

• https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqmVendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23961Mastodon is a free, open-source social network server based …5.3
• CVE-2026-23962Mastodon is a free, open-source social network server based …7.5
• CVE-2026-23963Mastodon is a free, open-source social network server based …6.5
• CVE-2026-23964Mastodon is a free, open-source social network server based …5.4
• CVE-2026-23965sm-crypto provides JavaScript implementations of the Chinese…7.5
• CVE-2026-23966sm-crypto provides JavaScript implementations of the Chinese…9.1
• CVE-2026-23968Copier is a library and CLI app for rendering project templa…5.5
• CVE-2026-23969Apache Superset utilizes a configurable dictionary, DISALLOW…6.5
• CVE-2026-2397Improper neutralization of special elements used in an SQL c…9.8
• CVE-2026-23970Unauthenticated Cross Site Scripting (XSS) in Redirection fo…7.1
• CVE-2026-23971Deserialization of Untrusted Data vulnerability in xtemos Wo…8.1
• CVE-2026-23972Missing Authorization vulnerability in magepeopleteam Bookin…6.5