OpenPubkey Vulnerable to Authentication Bypass

CRITICAL 9.8CVE-2025-3757 · GHSA-537f-gxgm-3jjq · GO-2025-3679 · Published 13/05/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/openpubkey/openpubkey Go	`< 0.10.0`	`0.10.0`
openpubkey openpubkey	`< 0.10.0`	`0.10.0`

Description

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

NVD description

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.