{"schema_version":"1.7.3","id":"GHSA-j7c9-79x7-8hpr","published":"2025-12-03T16:27:59Z","modified":"2026-02-04T02:16:38.317423Z","aliases":["CVE-2025-66406","GO-2025-4181"],"related":["CGA-pr93-635x-rq27"],"summary":"step-ca Has Improper Authorization Check for SSH Certificate Revocation","details":"## Summary\nAn authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.\n\n## Details\nStep CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.\n\nTo create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.\n\n## Impact\nThere is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.\n\n## Fix\nIn v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.\n\n## Acknowledgements\nThis issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\nStay safe, and thank you for helping us keep the ecosystem secure.","affected":[{"package":{"name":"github.com/smallstep/certificates","ecosystem":"Go","purl":"pkg:golang/github.com/smallstep/certificates"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.29.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.28.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-j7c9-79x7-8hpr/GHSA-j7c9-79x7-8hpr.json"}}],"references":[{"type":"WEB","url":"https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66406"},{"type":"PACKAGE","url":"https://github.com/smallstep/certificates"}],"database_specific":{"cwe_ids":["CWE-285","CWE-863"],"github_reviewed":true,"github_reviewed_at":"2025-12-03T16:27:59Z","nvd_published_at":"2025-12-03T20:16:26Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H"}]}