GitHub Advisoryadvisory · Go

GHSA-537f-gxgm-3jjq OpenPubkey Vulnerable to Authentication Bypass

CRITICAL Published 2025-05-13 Modified 2025-05-13 Official page ↗
Aliases
CVE-2025-3757
Ecosystem
Go
Packages
github.com/openpubkey/openpubkey
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Weaknesses
CWE-305
Reviewed
2025-05-13

Affected packages

• Go github.com/openpubkey/openpubkey: < 0.10.0 → fixed in 0.10.0

Description

Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. References CVE-2025-3757

Related

Alias · CVE (1)

  • CVE-2025-3757 Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature… vulnerability

Weakness · CWE (1)

  • CWE-305 Authentication Bypass by Primary Weakness weakness

References