Cyber ·
CVE-2026-109117: signature verification bypass in PSKC handling in libpskc
Public notice dated November 2, 2026 about CVE-2026-109117, a bypass in PSKC file signature verification in the libpskc library from the OATH Toolkit project. The text relays a message posted on the oss-sec list.
The notice was posted on the oss-sec list on November 2, 2026 and relays a message about CVE-2026-109117. According to the text, it is a bypass flaw in PSKC signature verification in the libpskc library, which is used to read one-time authentication key container files. The source is an automatic translation of an original message, so technical terms should be checked against the English version. The text does not state severity, affected versions or a fix, and these points should not be inferred from this summary.
To verify, consult the original oss-sec list archive from November 2026 and the OATH Toolkit project page named in the message, searching for the CVE identifier. Confirm the affected versions, the fixed version and the vendor guidance in official sources before acting.
For your organization, check whether you use libpskc or tools that include it, and plan the update according to the official notice. Rota Nacional does not patch third-party libraries. If applications that consume PSKC files send data to AI models, personal data detection and your organization's policies still apply before any call.