CVE-2026-23965
📋 TL;DR
A signature forgery vulnerability in sm-crypto's SM2 implementation allows attackers to create valid signatures for arbitrary public keys. This affects any application using sm-crypto versions before 0.4.0 for cryptographic operations. Attackers could bypass authentication or integrity checks by forging signatures.
💻 Affected Systems
- sm-crypto
📦 What is this software?
Sm Crypto by Juneandgreen
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of systems relying on SM2 signatures for authentication, allowing unauthorized access, data tampering, or privilege escalation.
Likely Case
Authentication bypass in applications using SM2 signatures, potentially leading to unauthorized API access or data manipulation.
If Mitigated
Limited impact if additional authentication layers exist or if SM2 signatures are not used for critical operations.
🎯 Exploit Status
The vulnerability is in the cryptographic implementation itself, making exploitation straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.0
Vendor Advisory: https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-hpwg-xg7m-3p6m
Restart Required: No
Instructions:
Update sm-crypto to version 0.4.0 or later using npm: npm update sm-crypto
Verify the update with: npm list sm-crypto
Test SM2 signature verification functionality after update
🔧 Temporary Workarounds
Disable SM2 signature verification
allTemporarily disable SM2 signature verification functionality until patching is possible
Implement additional signature validation
allAdd secondary signature validation using a different algorithm or library
🧯 If You Can't Patch
- Implement network segmentation to isolate systems using sm-crypto
- Add additional authentication layers beyond SM2 signatures
- Monitor for unusual authentication patterns or signature verification failures
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list sm-crypto | grep sm-cryptoCheck Version:
npm list sm-crypto | grep sm-cryptoVerify Fix Applied:
Verify installed version is 0.4.0 or higher: npm list sm-crypto📡 Detection & Monitoring
Log Indicators:
- Multiple failed signature verifications followed by successful ones
- Unusual patterns in authentication logs for SM2-signed requests
Network Indicators:
- Unusual traffic patterns to systems using SM2 authentication
- Requests with malformed or suspicious SM2 signatures
SIEM Query:
source="application_logs" AND ("SM2 signature" OR "sm-crypto") AND ("verification failed" OR "authentication bypass")