CVE-2025-4658: Authentication Bypass in OPKSSH
Vulnerability summary
CVE-2025-4658 is a critical (CVSS 9.8) vulnerability in openpubkey. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 13-05-2025PublishedVulnerability first disclosed.
- 13-05-2025Last modifiedVulnerability information updated.
Description
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · GoEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Openpubkey2 products
- openpubkey< 0.10.0
- opkssh< 0.5.0
Github.com/openpubkey1 product
- opkssh< 0.5.0
Opkssh1 product
- opkssh≥ 0.1.0, ≤ 0.4.0
Ubuntu1 product
- opksshAll versions (No fix recorded)
4 vendors · 5 products
