OpenPubkey Vulnerable to Authentication Bypass

CRÍTICO 9.8CVE-2025-3757 · GHSA-537f-gxgm-3jjq · GO-2025-3679 · Published 13/05/2025 · updated 17/06/2026

Em resumo

CVE-2025-3757 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta github.com/openpubkey/openpubkey, openpubkey (openpubkey).
Chance de exploração nos próximos 30 dias (EPSS): 0.43%, maior que 37.0% das vulnerabilidades.
Correção: atualize para 0.10.0 ou posterior.

Package	Affected versions	Patched versions
github.com/openpubkey/openpubkey Go	`< 0.10.0`	`0.10.0`
openpubkey openpubkey	`< 0.10.0`	`0.10.0`

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

NVD description

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.