Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation. This issue was fixed in version 463.
During digital signature verification, the SDK returns a value of 0 ('Positively verified') in the Result/@code field, even when the SigningCertificate/@certificateType field has the value 'nondetermined', which means it is impossible to determine the trust status of the signing certificate. Consumer applications read only the result code, interpreting it as confirmation of signature validity, while the actual certificate chain verification has actually failed. As a result, an attacker can use a signature based on an untrusted or unverifiable certificate, which will be incorrectly accepted by the application as authentic.
An attacker can perform authentication bypass and effectively impersonate another user by submitting a document with a digital signature based on an unverified certificate, which the SDK incorrectly recognizes as valid.
Sapphire SDK must be updated to version 463, where the issue has been fixed. Vendor: elektronicznypodpis.pl. Details available in references (https://cert.pl/posts/2026/05/CVE-2026-9058 and https://www.elektronicznypodpis.pl/).
Sapphire SDK in versions prior to version 463.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X