{"id":"CVE-2026-103902","details":"Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.","modified":"2026-10-14T07:12:27.269278170Z","published":"2026-10-12T11:17:08.617Z","database_specific":{"unresolved_ranges":[{"source":"DESCRIPTION","extracted_events":[{"introduced":"4.6.0"},{"fixed":"4.11.0"},{"introduced":"2.7.0"},{"fixed":"3.1.0"},{"introduced":"2.7.0"},{"fixed":"3.1.0"}]}]},"references":[{"type":"WEB","url":"https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/"},{"type":"FIX","url":"https://github.com/open-eid/libdigidocpp/pull/735"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-eid/libdigidocpp","events":[{"introduced":"72437deddd45d38e6a39d05f849430239595e9a1"},{"fixed":"bc64a76d46a524f92299ee5c57f6a91fc3e58ccb"}],"database_specific":{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.5.0"}],"source":"DESCRIPTION"}}],"versions":["v4.4.0","v4.3.0","v4.2.0","v4.1.0","v4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103902.json","vanir_signatures":[{"target":{"file":"src/digidoc-tool.cpp"},"deprecated":false,"digest":{"line_hashes":["312959972205632028230483251303063886147","93805658002638060122815703348188177908","69711266402591952504601960314919680947","70203620280218842368363274354291409124","4346753961849132922032821287453467603","177393883540411790573836519743645285933","338050174802615739915324879924577419432","108714037145691125561223776889784802819","21456362281263831829929420295654825463","327177442071404807151148206536985049751","241814844225100063444014749951036016584","274494766644415093696794491258817481568","142941975100481207219440167830830426235","107435632318039425845512893560780991869","147134573737290235284577579038261809708","258224101250907685813062929263046199077","127743667511833848645032761997051325348","59458320989002813863950933328606584163","86418597087599216150355888942961107275","35933469300476709780747217461590852428"],"threshold":0.9},"id":"CVE-2026-103902-33d5e796","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-eid/libdigidocpp/commit/bc64a76d46a524f92299ee5c57f6a91fc3e58ccb"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-eid/libdigidocpp/commit/bc64a76d46a524f92299ee5c57f6a91fc3e58ccb","target":{"file":"src/digidoc-tool.cpp","function":"ToolConfig::ToolConfig"},"deprecated":false,"digest":{"length":2687,"function_hash":"128878079623559237151710275958740382787"},"id":"CVE-2026-103902-9645cccc"},{"deprecated":false,"digest":{"length":4987,"function_hash":"305238429481044676657540943748768376924"},"id":"CVE-2026-103902-b9f76181","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-eid/libdigidocpp/commit/bc64a76d46a524f92299ee5c57f6a91fc3e58ccb","target":{"file":"src/digidoc-tool.cpp","function":"printUsage"}}],"vanir_signatures_modified":"2026-10-14T07:12:27Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}