Vulnerability in Openpubkey

CVE-2025-4658

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.

EPSS: 0.003 (21.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-4658?
CVE-2025-4658 is a critical-severity vulnerability in Openpubkey, classified under Authentication Bypass by Primary Weakness. CVSS score: 9.8/10. Published 2025-05-13.
How severe is CVE-2025-4658?
Critical severity. CVSS v3 base score is 9.8 out of 10.