AIKIDO-2026-134354
robrichards/xmlseclibs is vulnerable to Signature Forgery
91
Critical Risk
This Affects:
robrichards/xmlseclibsTL;DR
XMLSecurityDSig::verify() does not always bind the document's declared SignatureMethod to the algorithm type of the caller-supplied key. A signed document can be downgraded to hmac-sha1, causing the relying party's RSA public key to be used as the HMAC secret. The fix requires the SignatureMethod to match the supplied key algorithm and refuses to load asymmetric material as an HMAC key.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify XML signatures on documents from untrusted sources.
Background info
robrichards/xmlseclibs is vulnerable to Signature Forgery in versions 1.3.3 - 3.1.5.
How to fix this
Upgrade the robrichards/xmlseclibs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.