CVE-2026-64623

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64623", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-20T11:58:54.524Z", "datePublished": "2026-07-20T12:04:55.262Z", "dateUpdated": "2026-08-14T16:50:36.979Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-14T16:50:36.979Z"}, "datePublic": "2026-07-05T00:00:00.000Z", "title": "Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "descriptions": [{"lang": "en", "value": "Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Verification of Cryptographic Signature", "cweId": "CWE-347", "type": "CWE"}]}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "defaultStatus": "unaffected", "packageURL": "pkg:npm/network-ai", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "5.13.4"}, {"version": "5.13.4", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.13.4"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4", "name": "GitHub Security Advisory (GHSA-3jf7-33vc-hgf4)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/network-ai-before-cryptographic-signature-verification-bypass"}], "credits": [{"lang": "en", "value": "EQSTLab", "type": "reporter"}, {"lang": "en", "value": "useworld", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:48:35.799464Z", "id": "CVE-2026-64623", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:49:02.553Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64623", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:48:35.799464Z"}}}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:48:55.380Z"}}], "cna": {"title": "Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "credits": [{"lang": "en", "type": "reporter", "value": "EQSTLab"}, {"lang": "en", "type": "finder", "value": "useworld"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "versions": [{"status": "affected", "version": "0", "lessThan": "5.13.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.13.4", "versionType": "semver"}], "packageURL": "pkg:npm/network-ai", "defaultStatus": "unaffected"}], "datePublic": "2026-07-05T00:00:00.000Z", "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4", "name": "GitHub Security Advisory (GHSA-3jf7-33vc-hgf4)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/network-ai-before-cryptographic-signature-verification-bypass", "name": "VulnCheck Advisory: Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-14T16:50:36.979Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64623", "state": "PUBLISHED", "dateUpdated": "2026-08-14T16:50:36.979Z", "dateReserved": "2026-07-20T11:58:54.524Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-20T12:04:55.262Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/network-ai", "product": "Network-AI", "vendor": "Jovancoding", "versions": [{"lessThan": "5.13.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "5.13.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC."}, {"lang": "es", "value": "Network-AI anterior a 5.13.4 contiene una vulnerabilidad de verificaci\u00f3n de firma criptogr\u00e1fica impropia en APSAdapter donde el verificador local predeterminado acepta cualquier cadena no vac\u00eda como v\u00e1lida. Atacantes no autenticados pueden enviar cargas \u00fatiles de delegaci\u00f3n APS falsificadas con alcances arbitrarios para eludir la verificaci\u00f3n de firma y obtener tokens de concesi\u00f3n de permisos firmados para recursos sensibles, incluyendo SHELL_EXEC."}], "id": "CVE-2026-64623", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64623", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:48:35.799464Z", "version": "2.0.3"}}]}, "published": "2026-07-20T12:19:47.200", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/network-ai-before-cryptographic-signature-verification-bypass"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.13.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.13.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Network-AI", "source": "cna", "vendor": "Jovancoding"}, "product": "network-ai", "vendor": "jovancoding"}], "created": "2026-07-21T11:45:03.654021+00:00", "updated": "2026-07-30T19:30:09.716230+00:00", "vendors": ["jovancoding", "jovancoding$PRODUCT$network-ai"]}