---
id: CVE-2026-4258
title: >-
  Versions of the package sjcl before 1.0.9 are vulnerable to Improper
  Verification of Cryptographic Signature due to missing point-on-curve
  validation in sjcl.ecc.basicKey.publicKey()
summary: >-
  Versions of the package sjcl before 1.0.9 are vulnerable to Improper
  Verification of Cryptographic Signature due to missing point-on-curve
  validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a
  victim's ECDH private key b…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-347
  - CWE-325
vendor: bitwiseshiftleft
product: stanford_javascript_crypto_library
affected:
  - stanford_javascript_crypto_library <= 1.0.8
published: '2026-03-17'
updated: '2026-07-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4258'
references:
  - url: 'https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47'
    label: report@snyk.io
  - url: >-
      https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ecc.js%23L454-L461
    label: report@snyk.io
  - url: >-
      https://github.com/bitwiseshiftleft/sjcl/commit/ee307459972442a17beebc29dc331fffd8aff796
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15751243'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617'
    label: report@snyk.io
  - url: 'https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.16099
ingestedAt: '2026-07-28T16:37:03.215Z'
---

## Overview

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback.

## Affected

- `stanford_javascript_crypto_library <= 1.0.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.