CVE-2025-3757: Authentication Bypass in OpenPubKey
First published: Tue May 13 2025(Updated: )
### Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. ### Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. ### References [CVE-2025-3757 ](https://www.cve.org/CVERecord?id=CVE-2025-3757)
Credit: cna@cloudflare.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenPubkey | <0.10.0 | |
| go/github.com/openpubkey/openpubkey | <0.10.0 | 0.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3757?
CVE-2025-3757 is classified with a medium severity rating due to its potential to bypass signature verification.
How do I fix CVE-2025-3757?
To fix CVE-2025-3757, update the OpenPubkey library to version 0.10.0 or later.
What does CVE-2025-3757 affect?
CVE-2025-3757 affects versions of the OpenPubkey library prior to 0.10.0.
What type of vulnerability is CVE-2025-3757?
CVE-2025-3757 is a signature verification bypass vulnerability that involves specially crafted JSON Web Signatures (JWS).
Who is impacted by CVE-2025-3757?
Developers and organizations using the OpenPubkey library below version 0.10.0 are impacted by CVE-2025-3757.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-537f-gxgm-3jjq
- alias/CVE-2025-3757
- collector/nvd-cve
- agent/last-modified-date
- agent/references
- agent/source
- agent/tags
- agent/description
- agent/softwarecombine
- agent/event
- vendor/openpubkey
- canonical/openpubkey
- package-manager/go