DigiDoc Cryptographic Signature Verification Bypass

CVE-2026-103902 is a critical vulnerability in DigiDoc's digital signature libraries across desktop, Android, and iOS platforms that allows attackers to forge digital signatures accepted as valid by the affected software. This impacts the cryptographic integrity of signed documents, affecting users who rely on DigiDoc for legally binding digital signatures, notarization, and secure document authentication—particularly in regions where DigiDoc is a standard for e-government and enterprise document signing. The vulnerability stems from improper verification of cryptographic signatures (CWE-347), meaning the validation logic fails to properly authenticate the signature's authenticity, allowing crafted signatures to bypass security checks and appear legitimate to end users.

While this CVE lacks direct MITRE ATT&CK technique mappings, Casky.ai's 754 security skills enable detection of the underlying attack patterns through Claude AI's extended reasoning capabilities. Practitioners would identify this vulnerability through behavioral indicators including: anomalous signature validation sequences that bypass standard cryptographic checks, document signing operations that succeed despite malformed signature structures, and authentication workflows that fail to invoke proper ECDSA or RSA verification routines. Casky's skill correlation would surface related attack chains such as code tampering (T1599), supply chain compromise during library updates, and credential forgery scenarios where forged signatures substitute for legitimate ones. Security teams monitoring these platforms would observe attempts to abuse the signature verification gap—particularly in workflows processing batch documents or those with automated signature acceptance, where the visual validity display becomes a social engineering vector for fraud.