CVE-2026-103902

DigiDoc improper signature verification

State: Published
Severity: 7.5 High
Published: Oct 12, 2026
Updated: Oct 15, 2026
Reserved: Oct 1, 2026

Description

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	ENISA

Weaknesses

CWE-347 Improper verification of cryptographic signature

Affected Products

Product	Versions
libdigidocppDigiDoc	4.0.0 to before 4.5.0Affected
DigiDoc4DigiDoc	4.6.0 to before 4.11.0Affected
DigiDoc AndroidDigiDoc	2.7.0 to before 3.1.0Affected
DigiDoc iOSDigiDoc	2.7.0 to before 3.1.0Affected

References

https://github.com/open-eid/libdigidocpp/pull/735patch
https://www.id.ee/en/article/id-tarkvara-uus-versioon-267-on-avalikustatud/government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.