CVE-2025-44005

Description

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

References

https://github.com/mjholder/cve-agent

https://blog.talosintelligence.com/libbiosig-grassroot-dicom-smallstep-step-ca-vulnerabilities/

https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2242

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2242

https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201012

Details

Source: Mitre, NVD

Named Vulnerability: GO-2025-4180Named Vulnerability: GHSA-h8cp-697h-8c8p

Risk Information

CVSS v2

CVSS v3

EPSS