CVE-2025-3757 Authentication Bypass in OpenPubKey
A specially crafted JWS can bypass signature verification in the OpenPubKey library, allowing attackers to circumvent authentication mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3757?
CVE-2025-3757 is a critical authentication bypass vulnerability in OPKSSH, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.
Which versions are affected by CVE-2025-3757?
3 open source packages ship an affected version, including github.com/openpubkey/openpubkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openpubkey/openpubkey Go | All versions | 0.10.0 |
github.com/openpubkey/openpubkey Go | All versions | 0.10.0 |
github.com/openpubkey/openpubkey Go | All versions | 0.10.0 |
Products include Openpubkey Openpubkey.
How do I fix CVE-2025-3757?
Upgrade github.com/openpubkey/openpubkey to 0.10.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-3757 being exploited?
There is no known exploitation of CVE-2025-3757 in the wild and no public exploit code.
Other vulnerabilities in OPKSSH
Sources
Also known as DEBIAN-CVE-2025-3757, GHSA-537f-gxgm-3jjq, GO-2025-3679, UBUNTU-CVE-2025-3757.