The Szafir SDK performs automatic certificate chain building that causes it to import an untrusted parent CA certificate as a 'nonqualified' entry when a certificate contains an Authority Information Access caIssuers URI. After downloading and importing, the SDK returns code 0 and labels the certificate as nonqualified, or, for other untrusted certificates, it returns code 0 and marks the certificate as nondetermined. Because the SDK reports a successful verification regardless of the certificate’s trust state, applications may incorrectly accept a forged or untrusted signature as valid. This flaw enables authentication bypass and user impersonation in contexts that rely on qualified certificate authentication or in any area where the consuming application fails to implement additional validation logic. The vulnerability is rooted in improper certificate validation (CWE‑295), improper handling of certificate validation errors (CWE‑393), and misuse of trust states (CWE‑637).

Vendors affected include the Krajowa Izba Rozliczeniowa Szafir SDK. All releases before 1.8.463.2 are impacted, while 1.8.463.2 and later contain the fix that correctly treats nondetermined certificates as invalid.

The vulnerability has a CVSS score of 9.3, indicating critical severity. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary can supply a maliciously signed document or transaction to an application that consumes the SDK, leading to authentication bypass and user impersonation. Because the SDK returns a success status code regardless of the certificate’s trustworthiness, any application without additional verification steps is vulnerable to this bypass.