CVE-2025-4658 - Authentication Bypass in OPKSSH

Back Back to CVE browser

CRITICAL

Authentication Bypass in OPKSSH

Published May 13, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.34%

Description

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.

Affected products

Vendor Opkssh Product Opkssh Default
unaffected
- Version
  0.1.0
  Status
  affected
  Constraints
  <=0.4.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Opkssh

unaffected

Version	Status	Constraints
0.1.0	affected	<=0.4.0

Ecosystem	Package	Introduced	Fixed
Go	github.com/openpubkey/opkssh	0	0.5.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-305

CWE-347

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14477		Advisory
https://github.com/advisories/GHSA-56wx-66px-9j66		Advisory
https://github.com/openpubkey/opkssh		Product
https://github.com/openpubkey/opkssh/security/advisories/GHSA-56wx-66px-9j66
https://nvd.nist.gov/vuln/detail/CVE-2025-4658