CVE-2026-4602: jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
(updated )
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
References
- access.redhat.com/errata/RHSA-2026:19375
- access.redhat.com/errata/RHSA-2026:19409
- access.redhat.com/errata/RHSA-2026:19410
- access.redhat.com/errata/RHSA-2026:6568
- access.redhat.com/errata/RHSA-2026:6720
- access.redhat.com/errata/RHSA-2026:6912
- access.redhat.com/errata/RHSA-2026:6926
- access.redhat.com/security/cve/CVE-2026-4602
- bugzilla.redhat.com/show_bug.cgi?id=2450206
- gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5
- github.com/advisories/GHSA-8qwj-4jxw-m8jw
- github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195
- github.com/kjur/jsrsasign/pull/650
- nvd.nist.gov/vuln/detail/CVE-2026-4602
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4602.json
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812274
- security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175
Code Behaviors & Features
Detect and mitigate CVE-2026-4602 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →