GHSA-537f-gxgm-3jjq

ghsaUSosv

OpenPubkey Vulnerable to Authentication Bypass

view advisory published 2025-05-13Licence: CC-BY-4.0

### Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. ### Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. ### References [CVE-2025-3757 ](https://www.cve.org/CVERecord?id=CVE-2025-3757)

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-3757US	critical9.8	0.43% (37th)	—	2025-05-13
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

references

External citations — patches, advisories, analysis.

https://github.com/openpubkey/openpubkeyPACKAGE
https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjqWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-3757ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan