ANT-2026-KNXJMVYC: Universal ECCSI signature forgery in wolfSSL wc_VerifyEccsiHash via r = 0, s = 0

wolfSSL's ECCSI (RFC 6507) signature verifier, wc_VerifyEccsiHash() in wolfcrypt/src/eccsi.c, decoded the signature components r and s from the signature buffer with mp_read_unsigned_bin() and never checked that they lie in the range [1, q-1]. A signature carrying s = 0 makes the verification point J the point at infinity, whose x-coordinate is treated as 0, and with r = 0 the final comparison of J's x-coordinate against r succeeds, so the forged signature is accepted for any message and any signer identity using only publicly known constants. The issue is CVE-2026-5466 / GHSA-47qf-hp3h-rwmm, rated High, and is fixed in wolfSSL 5.9.1.

Target

Project: wolfSSL
Location: wolfcrypt/src/eccsi.c:wc_VerifyEccsiHash (and eccsi_calc_j)
Discovery: static analysis — not yet dynamically reproduced

Technical Details

ECCSI verification (RFC 6507, section 5.2.2) in wolfSSL decodes a signature of the form r | s | PVT, computes HE = hash(HS | r | M), Y = [HS]PVT + KPAK and J = [s]([HE]G + [r]Y), and accepts the signature when the x-coordinate of J compares equal to r. In wolfcrypt/src/eccsi.c, eccsi_decode_sig_r_pvt() and eccsi_decode_sig_s() read r and s with mp_read_unsigned_bin(); before the fix, the checks applied to the signature were its length and that PVT decodes to a point on the curve. Neither r nor s was validated against [1, q-1].

With s = 0, the scalar multiplication in eccsi_calc_j() returns the point at infinity, so J's x-coordinate is 0. With r = 0, the final mp_cmp(jx, r) == MP_EQ test in wc_VerifyEccsiHash() then holds and *verified is set to 1. Because this outcome does not depend on the message or the signer identity, an attacker who supplies r = 0 and s = 0 together with a PVT that is a valid curve point obtains a signature that verifies against any message for any identity, using only publicly known constants. The code is reachable by any application that passes attacker-controlled signatures to wc_VerifyEccsiHash() in a build with ECCSI support (WOLFCRYPT_HAVE_ECCSI).

• Impact: universal signature forgery / improper verification of cryptographic signature (CWE-347). Severity High (CVSS v3.1 base score 8.1 as recorded in the GitHub Advisory Database).
• Identifiers: CVE-2026-5466, GHSA-47qf-hp3h-rwmm.
• Fix: commit 13a016367ff4b4d3cc4c9bc2bfdfe692a512dd81 ("eccsi: fix universal signature forgery via r=0/s=0"), merged via wolfSSL PR #10102 and released in wolfSSL 5.9.1. The patch adds [1, q-1] range checks for r (in wc_VerifyEccsiHash(), after the curve parameters are loaded) and for s (in eccsi_calc_j(), after eccsi_decode_sig_s()), returning MP_ZERO_E or ECC_OUT_OF_RANGE_E and mirroring the existing wc_ecc_check_r_s_range() checks, and adds a defense-in-depth rejection of J = point at infinity (ECC_INF_E) before the final comparison.

/* added in wc_VerifyEccsiHash(); an equivalent check on s is added in eccsi_calc_j() */
if (err == 0) {
    if (mp_iszero(r)) {
        err = MP_ZERO_E;
    }
    else if (mp_cmp(r, ¶ms->order) != MP_LT) {
        err = ECC_OUT_OF_RANGE_E;
    }
}

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-KNXJMVYC.

Reference: ANT-2026-KNXJMVYC
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure