CVE-2026-33753

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Apr 8, 2026, 2:54:59 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.19% · Oct 25, 2026

A flaw was found in rfc3161-client, a Python library implementing the Time-Stamp Protocol (TSP). This authorization bypass vulnerability allows a remote attacker to impersonate a trusted TimeStamping Authority (TSA). The flaw exists in the library's signature verification process, specifically in how it extracts certificates from a PKCS#7 bag (a standard for cryptographic messages). An attacker can exploit a logic error to present a forged certificate, leading the library to incorrectly validate authorization rules and bypass intended TSA authorization pinning. rfc3161-client: rfc3161-client: Authorization bypass allows impersonation of TimeStamping Authority This vulnerability has a Moderate impact. A flaw in the rfc3161-client library, used by Red Hat Trusted Artifact Signer, allows an attacker to bypass authorization and impersonate a trusted TimeStamping Authority. This is due to a logic error in how the library extracts certificates during signature verification, enabling the use of a forged certificate to bypass TSA authorization pinning. As a consequence of a successful attack applications relying in `rfc3161-client` to validate the origin of a timestamp are exposed to impersonation, causing a high impact in the integrity of the data related to the validation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.