The loop variable capture flaw in goxmldsig's validateSignature function causes the internal reference pointer to reference the last element in the SignedInfo.References slice, regardless of matches. This allows crafted XML documents to bypass signature verification, enabling an attacker to alter the signed content while still passing validation.

Affected software includes the goxmldsig library distributed by russellhaering, versions prior to 1.6.0. Any application using this library to process XML signatures is susceptible.

The vulnerability carries a CVSS base score of 7.5 and has not been marked as commonly exploited. It is not listed in the KEV catalog and no exploit probability score is available. Likely exploitation requires the attacker to supply manipulated XML to a system that relies on goxmldsig for signature validation, such as an HTTP service or an XML processing pipeline.