CVE-2025-66406: Github.com/smallstep/certificates Step-ca Has Improper Authorization Check Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j7c9-79x7-8hpr",
  "modified" : "2025-12-20T02:28:23Z",
  "published" : "2025-12-03T16:27:59Z",
  "aliases" : [ "CVE-2025-66406" ],
  "summary" : "step-ca Has Improper Authorization Check for SSH Certificate Revocation",
  "details" : "## Summary\nAn authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.\n\n## Details\nStep CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.\n\nTo create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.\n\n## Impact\nThere is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.\n\n## Fix\nIn v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.\n\n## Acknowledgements\nThis issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\nStay safe, and thank you for helping us keep the ecosystem secure.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/smallstep/certificates"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.29.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.28.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66406"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/smallstep/certificates"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285", "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-03T16:27:59Z",
    "nvd_published_at" : "2025-12-03T20:16:26Z"
  }
}