{"id":"CVE-2025-4658","aliases":["EUVD-2025-14477","GHSA-56wx-66px-9j66","GO-2025-3680","UBUNTU-CVE-2025-4658","openSUSE-SU-2025:15135-1"],"status":"published","title":"Authentication Bypass in OPKSSH","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0034,"percentile":0.27747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305","CWE-347"],"published":"2025-05-13T16:33:35Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Go","package":"github.com/openpubkey/opkssh","fixed_in":["0.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openpubkey/opkssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openpubkey/opkssh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openpubkey/opkssh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opkssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opkssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-3","0.14.0-2","0.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"opkssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0-1","0.8.0-2","0.10.0-1","0.10.0-3","0.10.0-3ubuntu0.1~esm1","0.10.0-3ubuntu0.1","0.10.0-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250515T200012-1.1"}]}],"bundled":11}],"products":[{"vendor":"openpubkey","product":"openpubkey"},{"vendor":"openpubkey","product":"opkssh"},{"vendor":"opkssh","product":"opkssh"}],"references":[{"url":"https://github.com/openpubkey/opkssh","tags":["Product","package","report"]},{"url":"https://github.com/openpubkey/opkssh/security/advisories/GHSA-56wx-66px-9j66","tags":["web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4658","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-56wx-66px-9j66"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4658.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4658","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46816","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4658","title":"Authentication Bypass in OPKSSH","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","status":"published","published":"2025-05-13T16:33:35.195Z","modified":"2025-05-13T20:11:58.123Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-14477","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","status":"published","published":"2025-05-13T16:33:35Z","modified":"2025-05-13T20:11:58Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"updated_at":"2026-11-02T20:32:48.430739Z"}],"ghsa":[{"id":"GHSA-56wx-66px-9j66","title":"OPKSSH Vulnerable to Authentication Bypass ","description":"### Impact\n\nVersions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.\n\n### Patches\n\nThe vulnerability does not exist in more recent versions of OPKSSH. his only impacts OPKSSH  when used to verify ssh keys on a server, the OPKSSH client is unaffected. To remediate upgrade to a version of OPKSSH v0.5.0 or greater.\n\nTo determine if you are vulnerable run on your server:\n\n```bash\nopkssh --version\n```\n\nIf the version is less than 0.5.0 you should upgrade. To upgrade to the latest version run:\n\n```bash\nwget -qO- \"https://raw.githubusercontent.com/openpubkey/opkssh/main/scripts/install-linux.sh\" | sudo bash\n``` \n\n\n### References\n\n[CVE-2025-4658](https://www.cve.org/CVERecord?id=CVE-2025-4658)\n\nThe upstream vulnerability in OpenPubkey is [CVE-2025-3757](https://www.cve.org/CVERecord?id=CVE-2025-3757) and has the security advisory https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq","status":"published","published":"2025-05-13T21:34:58Z","modified":"2025-05-13T21:35:00Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2025-4658","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","status":"published","published":"2025-05-13T17:16:04.953Z","modified":"2026-06-17T09:33:43.513Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-305","CWE-347"],"updated_at":"2026-11-02T14:11:07.176032Z"}],"osv":[{"id":"CVE-2025-4658","title":"Authentication Bypass in OPKSSH","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","status":"published","published":"2025-05-13T16:33:35.195Z","modified":"2026-10-28T02:30:55.659711832Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-56wx-66px-9j66","title":"OPKSSH Vulnerable to Authentication Bypass ","description":"### Impact\n\nVersions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.\n\n### Patches\n\nThe vulnerability does not exist in more recent versions of OPKSSH. his only impacts OPKSSH  when used to verify ssh keys on a server, the OPKSSH client is unaffected. To remediate upgrade to a version of OPKSSH v0.5.0 or greater.\n\nTo determine if you are vulnerable run on your server:\n\n```bash\nopkssh --version\n```\n\nIf the version is less than 0.5.0 you should upgrade. To upgrade to the latest version run:\n\n```bash\nwget -qO- \"https://raw.githubusercontent.com/openpubkey/opkssh/main/scripts/install-linux.sh\" | sudo bash\n``` \n\n\n### References\n\n[CVE-2025-4658](https://www.cve.org/CVERecord?id=CVE-2025-4658)\n\nThe upstream vulnerability in OpenPubkey is [CVE-2025-3757](https://www.cve.org/CVERecord?id=CVE-2025-3757) and has the security advisory https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq","status":"published","published":"2025-05-13T21:34:58Z","modified":"2025-05-15T20:41:49.515714Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2025-4658","description":"Versions of OpenPubkey library prior to 0.10.0  contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.","status":"published","published":"2025-05-13T17:16:00Z","modified":"2026-10-17T12:56:51.984082724Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"GO-2025-3680","title":"OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh","description":"OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh","status":"published","published":"2025-05-15T20:00:12Z","modified":"2026-03-03T04:56:33.643285Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15135-1","title":"govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250515T200012-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-20T00:00:00Z","modified":"2026-02-05T09:20:55.285479Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}