CVE-2026-4541 describes a low-severity cryptographic signature verification flaw in janmojzis tinyssh versions up to 20250501, specifically affecting the Ed25519 Signature Handler. This vulnerability, rated CVSS 2.5 Low, requires local access and has high attack complexity, potentially leading to improper cryptographic signature verification but no direct impact on confidentiality or availability. While an exploit has reportedly been published, its exploitability is considered difficult, and there is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Janmojzis | Tinyssh | 20250501CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.