CVE-2026-103902: DigiDoc improper signature verification
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.
Affected Software
Event History
Frequently Asked Questions
Which versions need to be remediated?
Affected versions are libdigidocpp 4.0.0 through versions before 4.5.0, DigiDoc4 4.6.0 through versions before 4.11.0, and DigiDoc Android and iOS 2.7.0 through versions before 3.1.0. Upgrade to libdigidocpp 4.5.0 or later, DigiDoc4 4.11.0 or later, and DigiDoc Android or iOS 3.1.0 or later.
What could an attacker do?
An attacker could create forged digital signatures that affected DigiDoc software displays as valid. The listed severity vector indicates network exploitation with low attack complexity and no required privileges or user interaction, with integrity impact.
How can we determine whether our environment is affected?
Identify DigiDoc clients and any applications that include or rely on libdigidocpp, then compare their installed versions with the affected ranges. Systems running versions before the stated fixed releases should be treated as affected.