Open-source package vulnerability · Go

CVE-2025-3757: OpenPubkey Vulnerable to Authentication Bypass

criticalCVSS 4.0 9.3GHSA-537f-gxgm-3jjq

Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. References CVE-2025-3757

Published May 13, 2025

Affected packages

github.com/openpubkey/openpubkey

Ecosystem: Go
Affected: < 0.10.0
Fixed in: 0.10.0
Check: go list -m github.com/openpubkey/openpubkey

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Patches

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

References

CVE-2025-3757

Credited to EthanHeilman.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology