N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3757

CVE-2025-3757: OpenPubkey Vulnerable to Authentication Bypass

Impact

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.

Patches

Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0.

References

CVE-2025-3757

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3757

CVE-2025-3757:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openpubkey/openpubkey	go	< 0.10.0	0.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is that versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. The patch is to upgrade to v0.10.0 or greater. The commit f1d8d24280535bc8a88586a84f9bbe612cf8a015, which is between v0.9.0 and v0.10.0, modifies the requestTokens function in providers/standard_provider.go by adding rp.WithSigningAlgsFromDiscovery(). This change implies that the previous versions were not discovering signing algorithms correctly, potentially leading to the signature bypass. However, the provided patch information is insufficient to pinpoint the exact vulnerable function that processes the JWS and performs signature verification. The change in requestTokens is more of a mitigation by ensuring correct algorithm discovery. Without seeing the actual JWS parsing and verification logic, it's hard to definitively name the vulnerable function. The vulnerability description mentions a "specially crafted JWS to bypass signature verification", which suggests the vulnerability lies in the JWS processing logic itself, not necessarily in how tokens are requested. Therefore, I cannot confidently identify the vulnerable functions based on the provided information and will return an empty list as per the instructions to avoid hallucination. More information on the JWS processing and signature verification parts of the codebase would be needed to make a definitive assessment. The commit d6907a99021f102d115fd1f2d40c5fa973975256 is related to adding test coverage and is not directly related to the vulnerability fix itself.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.