{"id":"CVE-2025-66406","sourceIdentifier":"security-advisories@github.com","published":"2025-12-03T20:16:26.560","lastModified":"2026-10-18T17:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0."},{"lang":"es","value":"Step CA es una autoridad de certificación en línea para la gestión segura y automatizada de certificados para DevOps. Versiones anteriores a la 0.29.0, existe una comprobación de autorización incorrecta para la revocación de certificados SSH. Esto afecta a los despliegues configurados con el provisionador SSHPOP. Esta vulnerabilidad está corregida en la 0.29.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"smallstep","product":"certificates","versions":[{"version":"< 0.29.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-03T21:40:49.793375Z","id":"CVE-2025-66406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr","source":"security-advisories@github.com"}]}