{"id":"CVE-2026-4258","title":"Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey()","summary":"Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key b…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-347","CWE-325"],"vendor":"bitwiseshiftleft","product":"stanford_javascript_crypto_library","affected":["stanford_javascript_crypto_library <= 1.0.8"],"published":"2026-03-17","updated":"2026-07-28","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4258","references":[{"url":"https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47","label":"report@snyk.io"},{"url":"https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ecc.js%23L454-L461","label":"report@snyk.io"},{"url":"https://github.com/bitwiseshiftleft/sjcl/commit/ee307459972442a17beebc29dc331fffd8aff796","label":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15751243","label":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617","label":"report@snyk.io"},{"url":"https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00246,"epssPercentile":0.16082,"ingestedAt":"2026-07-28T16:37:03.215Z","slug":"CVE-2026-4258","body":"## Overview\n\nVersions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback.\n\n## Affected\n\n- `stanford_javascript_crypto_library <= 1.0.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}