The Szafir SDK incorrectly reports a successful signature verification (code 0) even when the signer's certificate trust status could not be established, as indicated by the nondetermined certificate type. This flaw means that applications relying on the SDK may accept forged or untrusted signatures as valid, allowing an attacker to impersonate legitimate users or bypass authentication controls. The weakness is rooted in improper handling of certificate validation errors (CWE‑393) and insufficient certificate trust verification (CWE‑637).

Vendors affected include the Krajowa Izba Rozliczeniowa Szafir SDK. All releases before version 463 are impacted, while version 463 and later contain the fix that correctly treats nondetermined certificates as invalid.

The vulnerability has a CVSS score of 9.3, indicating critical severity. EPSS is not available, so precise exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary can supply a maliciously signed document or transaction to an application that consumes the SDK, leading to authentication bypass and user impersonation. Because the SDK returns a success status code regardless of the certificate’s trustworthiness, any application without additional verification steps is vulnerable to this bypass.