XML-Security signxml up to 4.0.3 incorrect implementation of authentication algorithm

Summaryinfo

A vulnerability identified as problematic has been detected in XML-Security signxml up to 4.0.3. This affects an unknown part. Performing a manipulation results in incorrect implementation of authentication algorithm. This vulnerability is identified as CVE-2025-48994. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in XML-Security signxml up to 4.0.3. This affects some unknown functionality. The manipulation with an unknown input leads to a incorrect implementation of authentication algorithm vulnerability. CWE is classifying the issue as CWE-303. The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. This is going to have an impact on integrity. The summary by CVE is:

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-48994 since 05/29/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 264326 (Linux Distros Unpatched Vulnerability : CVE-2025-48994), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.0.4 eliminates this vulnerability. Applying the patch e3c0c2b82a3329a65d917830657649c98b8c7600 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (264326). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• XML-Security

Name

• signxml

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

License

• open-source

Website

• Product: https://github.com/XML-Security/signxml/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion