CVE-2026-0809 Weak KSeF token encoding in Streamsoft Prestiż

MediumCVSS 6.3 EPSS 0.29%

Published: 2026-03-12 15:02
Updated: 2026-06-17 13:11
Exploit status: No public exploit known

Description

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded.

This issue was fixed in version 20.0.380.92.

Affected products

Product	Affected versions	Fixed in
Streamsoft Prestiż	>= 12.2.363.17, < 20.0.380.92	20.0.380.92

References

www.streamsoft.pl product
cert.pl third-party-advisory

CVSS v4.0

6.3 Medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: Low
Vulnerable System Integrity: None
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 6.3 · cert-pl
v4.0 6.3 · cvd@cert.pl

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.29% (percentile 22.0)
CWE: CWE-261 Weak Encoding for Password

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.