CVE-2025-4658

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305 CWE-347

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-465807.5There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation o CVE-2025-465819.8ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute com CVE-2025-465827.7A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the CVE-2025-465835.3There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the CVE-2025-465845.5Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilit CVE-2025-465857.0Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availabil CVE-2025-465865.5Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-465875.5Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confid CVE-2025-465887.7Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and CVE-2025-465897.1Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and CVE-2025-46595.3The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Pa CVE-2025-465906.5Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypas