SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack
Date: 2025-06
Affected: pip/signxml
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-48994
CWE: CWE-303

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), prior versions of SignXML are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with signxml 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user.


Mitigations:

Architectural layers (MAESTRO):