GHSA-537f-gxgm-3jjq
OpenPubkey Vulnerable to Authentication Bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/openpubkey/openpubkey | < 0.10.0 | 0.10.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.
### Patches
Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.
### References
[CVE-2025-3757 ](https://www.cve.org/CVERecord?id=CVE-2025-3757)
References
External links from the advisory. They lead to third-party sites.