VYPR
← All advisories
High severity8.6OSV Advisory· Published Jul 20, 2026· Updated Jul 23, 2026

CVE-2026-64623

CVE-2026-64623

Description

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC.

Affected products

2
  • Jovancoding/Network AIOSV2 versions
    v5.13.3, v5.13.2, v5.13.1, …+ 1 more
    • (no CPE)range: v5.13.3, v5.13.2, v5.13.1, …
    • (no CPE)range: <5.13.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.