CVE-2025-4658criticalCWE-305

CVE-2025-4658: critical vulnerability in OPKSSH

Authentication Bypass in OPKSSH

Published

Follow this CVE+ Monitor OPKSSH+ Monitor github.com/openpubkey/opkssh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.3%
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
OPKSSH · OPKSSH
Related CVEs — OPKSSH

In the same product, most dangerous first.

CVE-2025-3757CRITICALAuthentication Bypass in OpenPubKeyEPSS 0.4%