The jsrsasign library contains a numeric conversion flaw that permits unauthenticated attackers to bypass cryptographic signature verification, potentially leading to unauthorized data acceptance.

This vulnerability is caused by an incorrect conversion between numeric types in the ext/jsbn2.js file, which fails to safely handle negative exponents. An unauthenticated attacker can exploit this via the modPow function to corrupt cryptographic operations.

The integrity of systems relying on jsrsasign for digital signature verification is at significant risk. Successful exploitation could allow attackers to bypass security controls by spoofing signatures, leading to unauthorized access or the acceptance of malicious data as authentic. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent potential service compromise.

Immediate Action: Update the jsrsasign package to version 11.1.1 or later immediately to resolve the vulnerable numeric conversion logic.

Proactive Monitoring: Review application logs for unusual inputs or errors related to cryptographic operations, particularly those involving high-frequency calls to signature verification modules.

Compensating Controls: Implement strict input validation at the application layer to reject unexpected numeric parameters before they reach the underlying cryptographic library.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub Gist.

Organizations utilizing the jsrsasign library must prioritize patching to version 11.1.1. Because this vulnerability targets the core signature verification mechanism, it provides an attractive vector for attackers to undermine system security. Applying the provided vendor update is the only definitive method to eliminate this risk and restore the integrity of cryptographic processes.