Advisory CVE-2026-109117: signature verification bypass in PSKC parsing in libpskc

What happened and what to do

The security advisory, published on 2 November 2026 by Simon Josefsson on the oss-sec list and linked to the OATH Toolkit project discussions, describes CVE-2026-109117: a bypass flaw in signature verification of PSKC (Portable Symmetric Key Container) files in the libpskc library. The available text identifies the affected component and the type of failure, which allows the signature check to be circumvented.

In practical terms, a company that uses libpskc to import symmetric keys from OTP tokens should first find where the library appears, directly or as a third-party dependency, using a software inventory and an SBOM. It should then apply the fix published by the project as soon as it is available, and treat untrusted PSKC inputs as unvalidated until the update is deployed. Automated regression tests with correctly and incorrectly signed containers can confirm that verification rejects tampered signatures. Dependency alert monitoring integrated into the build pipeline shortens the time between an advisory and the deployed fix.

How the consultancy can help

Assessment of exposure to CVE-2026-109117: mapping where libpskc is used, reviewing the key import flow and planning the fix. Then implementation of signature regression tests and continuous dependency monitoring in your pipeline.

Next step

If your company uses libpskc or imports PSKC containers from token vendors, send a short description of your environment and import flow. We reply with a scoped proposal, timelines and options for per-project or monthly engagement.