CVE-2025-3757

Authentication Bypass in OpenPubKey

9.3 CriticalFix available

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.43%Up 0.4 points since May 14, 2025

What each source reports

CVE List Score used 9.3

Authentication Bypass in OpenPubKey

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: CVE-2025-3757
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/AU:Y
Weakness: CWE-305
Updated: 2026-11-02

EUVDEUVD-2025-14478 9.3

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: EUVD-2025-14478
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/AU:Y
Updated: 2026-11-02

GitHub AdvisoriesGHSA-537f-gxgm-3jjq 9.3

OpenPubkey Vulnerable to Authentication Bypass

Impact

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Patches

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

References

CVE-2025-3757

Record: GHSA-537f-gxgm-3jjq
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Weakness: CWE-305
Updated: 2026-11-02

NVD 9.3

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: CVE-2025-3757
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-305, CWE-347
Updated: 2026-11-02

OSV 9.3

Authentication Bypass in OpenPubKey

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: CVE-2025-3757
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/AU:Y
Weakness: CWE-305
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-3757 9.8

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: DEBIAN-CVE-2025-3757
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-537f-gxgm-3jjq 9.3

OpenPubkey Vulnerable to Authentication Bypass

Impact

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Patches

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

References

CVE-2025-3757

Record: GHSA-537f-gxgm-3jjq
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Weakness: CWE-305
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-3757 9.3

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Record: UBUNTU-CVE-2025-3757
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/AU:Y
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGO-2025-3679 No score

OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey

OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey

Record: GO-2025-3679
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15135-1 No score

govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250515T200012-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15135-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/openpubkey/openpubkey` Go	before 0.10.0	0.10.0
`golang-github-openpubkey-openpubkey` Debian:13	All versions, plus listed versions 0.18.0-10.21.0-10.21.0-1~exp00.21.0-20.22.0-10.23.0-10.26.0-10.8.0-1	None known
`golang-github-openpubkey-openpubkey` Debian:14	before 0.18.0-1, plus listed versions 0.8.0-1	0.18.0-1
`golang-github-openpubkey-openpubkey` Ubuntu:25.10	All versions, plus listed versions 0.8.0-1	None known
`golang-github-openpubkey-openpubkey` Ubuntu:26.10	All versions, plus listed versions 0.21.0-10.23.0-10.26.0-1	None known
`golang-github-openpubkey-openpubkey` Ubuntu:26.04:LTS	All versions, plus listed versions 0.8.0-10.18.0-10.21.0-1	None known
`govulncheck-vulndb` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 0.0.20250515T200012-1.1	0.0.20250515T200012-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-3757 is a critical vulnerability (CVSS 9.3) in Openpubkey, published May 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in github.com/openpubkey/openpubkey 0.10.0.

References

Show 14 moreShow less