CVE-2025-4658
Last modified
CVE-2025-4658 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openpubkey | Openpubkey | < 0.10.0 |
| Openpubkey | Opkssh | < 0.5.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-4658?
How severe is CVE-2025-4658?
How do I fix CVE-2025-4658?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-46574There is an information disclosure vulnerability in the Gold…5.3
- CVE-2025-46575There is an information disclosure vulnerability in the Gold…7.5
- CVE-2025-46576There is a Permission Management and Access Control vulnerab…6.5
- CVE-2025-46577There is a SQL injection vulnerability in the GoldenDB datab…7.5
- CVE-2025-46578There are SQL injection vulnerabilities in multiple interfac…7.5
- CVE-2025-46579There is a DDE injection vulnerability in the GoldenDB datab…7.8
- CVE-2025-46580There is a code-related vulnerability in the GoldenDB databa…7.5
- CVE-2025-46581ZTE's ZXCDN product is affected by a Struts remote code exe…9.8
- CVE-2025-46582A private key disclosure vulnerability exists in ZTE's ZXMP …7.7
- CVE-2025-46583There is a Denial of Service（DoS）vulnerability in the ZTE MC…5.3
- CVE-2025-46584Vulnerability of improper authentication logic implementatio…5.5
- CVE-2025-46585Out-of-bounds array read/write vulnerability in the kernel m…7
Are you affected by CVE-2025-4658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST