critical9.3
CVE-2025-3757
OpenPubkey Vulnerable to Authentication Bypass
Impact
### Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. ### Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. ### References [CVE-2025-3757 ](https://www.cve.org/CVERecord?id=CVE-2025-3757)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openpubkey/openpubkey | < 0.10.0 | 0.10.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openpubkey | Openpubkey | before 0.10.0 |