CVE-2026-9058
The vulnerability in Szafir SDK allows untrusted certificates to be treated as valid, enabling attackers to bypass authentication and impersonate users. It occurs when the SDK automatically downloads a parent CA certificate from a URL specified in the certificate’s Authority Information Access extension. The flaw can be exploited by applications that rely on the SDK for certificate validation.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Szafir SDK versions prior to 1.8.463.2 used in applications that perform certificate authentication.
Real-world impact
An attacker could use this flaw to impersonate legitimate users or bypass authentication in systems that integrate the affected Szafir SDK, potentially gaining unauthorized access to protected resources.
Why this severity
The CVSS score of 9.3 reflects the high impact of authentication bypass with no user interaction, the ability to compromise confidentiality and integrity, and the lack of mitigations in the affected SDK.
What to do about it
- 01Upgrade Szafir SDK to version 1.8.463.2 or later.
NVD-referenced vendor advisory
Timeline
- May 25, 2026 · May 25, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.