CVE-2025-26787 Auth bypass in n/a
A logic error resets access controls to allow any trusted client certificate on restart, bypassing intended restrictions in Keyfactor SignServer.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26787?
CVE-2025-26787 is a medium-severity authentication bypass vulnerability in n/a, published on 22 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth certificate to connect. Admins can then set more restricted access to specific certificates. A logic error caused this admin CLI command to be run on each restart of the container instead of only the first startup as intended resetting the configuration to "allowany".
Weakness: CWE-642
Which versions are affected by CVE-2025-26787?
It affects 1 product.
Products include Keyfactor Signserver.
How do I fix CVE-2025-26787?
No fix has been published for CVE-2025-26787 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-26787 being exploited?
There is no known exploitation of CVE-2025-26787 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-93g4-gwqx-xffr.