CVE-2025-69287

The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. The vulnerability was located in the `Peer.ts` file of the TypeScript SDK, specifically in the `processInitialRequest` and `processInitialResponse` methods where signature data is prepared for BRC-104 mutual authentication. The TypeScript SDK incorrectly prepared signature data by concatenating base64-encoded nonce strings (`message.initialNonce + sessionNonce`) then decoding the concatenated base64 string (`base64ToBytes(concatenatedString)`). This produced ~32-34 bytes of signature data instead of the correct 64 bytes. BRC-104 authentication relies on cryptographic signatures to establish mutual trust between peers. When signature data preparation is incorrect, signatures generated by the TypeScript SDK don't match those expected by Go/Python SDKs; cross-implementation authentication fails; and an attacker could potentially exploit this to bypass authentication checks. The fix in version 2.0.0 ensures all SDKs now produce identical cryptographic signatures, restoring proper mutual authentication across implementations.

• CWE-573

• https://github.com/bsv-blockchain/ts-sdk/commit/d8cf6930028372079d977138ae9eaa03ae2f50bb
• https://github.com/bsv-blockchain/ts-sdk/security/advisories/GHSA-vjpq-xx5g-qvmm

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69277libsodium before ad3004e, in atypical use cases involving ce…4.5
• CVE-2025-69278In nr modem, there is a possible system crash due to imprope…7.5
• CVE-2025-69279In nr modem, there is a possible system crash due to imprope…7.5
• CVE-2025-69284Plane is an an open-source project management tool. In plane…4.3
• CVE-2025-69285SQLBot is an intelligent data query system based on a large …6.1
• CVE-2025-69286RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…9.8
• CVE-2025-69288Titra is open source project time tracking software. Prior t…9.1
• CVE-2025-69289Discourse is an open source discussion platform. A privilege…5.4
• CVE-2025-6929A vulnerability was found in PHPGurukul Zoo Management Syste…8.8
• CVE-2025-69290Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-69291Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-69292Incorrect Privilege Assignment vulnerability in e-plugins WP…8.8