CVE-2025-4658 Authentication Bypass in OPKSSH
Attackers can bypass authentication in OPKSSH by crafting a malicious JWS that evades signature verification in the underlying OpenPubkey library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4658?
CVE-2025-4658 is a critical authentication bypass vulnerability in OPKSSH, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
Which versions are affected by CVE-2025-4658?
3 open source packages ship an affected version, including github.com/openpubkey/opkssh. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openpubkey/opkssh Go | All versions | 0.5.0 |
github.com/openpubkey/opkssh Go | All versions | 0.5.0 |
github.com/openpubkey/opkssh Go | All versions | 0.5.0 |
Products include Openpubkey Openpubkey, Openpubkey Opkssh.
How do I fix CVE-2025-4658?
Upgrade github.com/openpubkey/opkssh to 0.5.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-4658 being exploited?
There is no known exploitation of CVE-2025-4658 in the wild and no public exploit code.
Other vulnerabilities in OPKSSH
Sources
Also known as GHSA-56wx-66px-9j66, GO-2025-3680, UBUNTU-CVE-2025-4658.