CVE-2026-4648: Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025), which employs cards based on MIFARE Classic technology (FM11RF08S). The cryptographic weakness of the authentication algorithm allows an attacker to retrieve access keys using techniques known as Backdoored Nested Attack, read the wristband’s entire contents, and clone its credentials onto a compatible rewritable card. Exploitation of this vulnerability could enable the impersonation of other attendees, the fraudulent use of the balance associated with their wristbands, and financial losses for both the affected users and the event organizers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of MIFARE Classic chips (e.g., FM11RF08S) for cashless payment systems and critical access control systems, since the vulnerability is a hardware-level cryptographic weakness inherent to the MIFARE Classic family.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4648?
The severity of CVE-2026-4648 is rated at 62, indicating a medium risk level.
How do I fix CVE-2026-4648?
To fix CVE-2026-4648, ensure that more secure cryptographic algorithms are implemented in the NFC wristband payment system.
What type of vulnerability is CVE-2026-4648?
CVE-2026-4648 is categorized as a Weak Encryption vulnerability.
Which technology is affected by CVE-2026-4648?
CVE-2026-4648 affects the NXP MIFARE Classic (FM11RF08S) technology used in cashless payment systems.
Who is impacted by CVE-2026-4648?
Organizations using CasfID Servicios Tecnológicos NFC wristbands for cashless payments are impacted by CVE-2026-4648.