The vulnerability is an incorrect conversion between numeric types in the jsrsasign library. When a negative exponent is passed to the modPow function in ext/jsbn2.js, the library computes an incorrect modular inverse, leading to a signature verification bypass. An attacker able to supply such input can forge signatures for any data validated by the library, potentially compromising code integrity or authentication mechanisms. The weakness corresponds to CWE‑681.

The affected product is the jsrsasign JavaScript library, used in Node.js projects. All releases before version 11.1.1 are vulnerable. Projects that rely on jsrsasign to validate cryptographic signatures of external data are at risk.

The CVSS score of 8.7 indicates a high severity, but the EPSS score lower than 1 percent suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no documented exploitation yet. Attackers would need the ability to influence the input data that triggers the modPow function, which typically occurs in scenarios where an application accepts untrusted signatures. Once the input is controlled, the attacker can bypass verification and potentially inject malicious content.