THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-4602 (HIGH 7.5) — Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow

[NVD] CVE-2026-4602 (HIGH 7.5) — Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow

lownvdPublished 2026-03-23

CVE-2026-4602 CVSS: 7.5 HIGH Published: 2026-03-23T06:16:22.070

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Indicators of compromise

CVE-2026-4602cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-4602