{"id":"GHSA-j7c9-79x7-8hpr","revision":"afc321d5fdfe4d1cab222fda27ee7b77","records":[{"revision":"afc321d5fdfe4d1cab222fda27ee7b77","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-j7c9-79x7-8hpr","aliases":["CVE-2025-66406","GO-2025-4181"],"title":"step-ca Has Improper Authorization Check for SSH Certificate Revocation","description":"## Summary\nAn authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.\n\n## Details\nStep CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.\n\nTo create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.\n\n## Impact\nThere is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.\n\n## Fix\nIn v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.\n\n## Acknowledgements\nThis issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\nStay safe, and thank you for helping us keep the ecosystem secure.","state":0,"publishedAt":"2025-12-03T16:27:59+00:00","modifiedAt":"2026-09-10T03:50:31.9993394+00:00","affected":[{"ecosystem":"Go","name":"github.com/smallstep/certificates","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.29.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr","https://nvd.nist.gov/vuln/detail/CVE-2025-66406","https://github.com/smallstep/certificates"],"sourceUrl":"https://github.com/advisories/GHSA-j7c9-79x7-8hpr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j7c9-79x7-8hpr","identifiers":["GHSA-j7c9-79x7-8hpr","CVE-2025-66406","GO-2025-4181"]},"retained":false,"historicalAffected":[]}],"coverage":[]}