CVE-2025-44005

Description

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

References

https://blog.talosintelligence.com/libbiosig-grassroot-dicom-smallstep-step-ca-vulnerabilities/

https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2242

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2242

https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS