CVE-2026-4648: Insufficient Encryption in Casfid NFC Wristbands (MiFare Classic)

Vulnerability Overview Vulnerability Name: Insufficient Encryption Level in Casfid Servicios Tecnológicos NFC Wristbands Publication Date: July 28, 2026 Identifier: INCIBE-2026-513 Severity: 3 - Medium CVSS Score: 6.8 CVE ID: CVE-2026-4648 Description INCIBE coordinated the disclosure of a high-severity vulnerability affecting the cashless payment system based on NFC wristbands provided by Casfid Servicios Tecnológicos. The vulnerability was discovered by Luis Miranda Acebedo. Affected Resources Affected Resources: MiFare Classic chip family, specifically the FM11RF08S variant. Remediation Since the vulnerability stems from inherent hardware-level encryption weaknesses within the MiFare Classic family, it is recommended to cease using these chips (such as the FM11RF08S variant) for payment and critical access control systems. As a final solution, organizations should migrate to smart card technologies that support stronger, modern encryption standards (such as AES-128 or higher), such as the MiFare DESFire family (EV2 or EV3). Details CVE-2026-4648 concerns the use of an insecure encryption algorithm (present since Easter 2024) in the cashless payment system of Casfid Servicios Tecnológicos S.L.U., which utilizes wristbands based on MiFare Classic technology (PM11RF08S). The cryptographic weaknesses in the authentication algorithm allow attackers to retrieve the access key using a technique known as the Backdoored Nested Attack, read the entire contents of the wristband, and clone its credentials onto a compatible rewritable card. Exploiting this vulnerability may lead to impersonation of other participants, fraudulent use of balances associated with the wristbands, and financial losses for affected users and event organizers.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-4648: Insufficient Encryption in Casfid NFC Wristbands (MiFare Classic)