CVE-2024-23680

CVE-2024-23680: AWS Encryption SDK for Java Improper Verification of Cryptographic Signature

Weakness CWE-347

Published January 19, 2024

Last update November 29, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

Key dates

02Disclosure timeline

January 19, 2024 CVE published

November 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-23680 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/347.html AskarLabs — CWE-347 write-up Improper Verification of Cryptographic Signature

Related vulnerabilities

04Related CVE

CVE-2026-9027 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint CVE-2025-9485 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token() CVE-2026-42743 WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability CVE-2026-28148 WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability CVE-2026-5050 Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation