Executive brief
Step CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates
Affected products
- Go github.com/smallstep/certificates
Junglewise Threat Intelligence
CVE-2025-44005: GO-2025-4180 - Step CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates
CVE-2025-44005 · Severity: low · CVSS 3.1 · Published 2025-12-08
Technologies: github.com/smallstep/certificates (Go). Vendors: Go.
Related threats
- Smallstep Step CA index out-of-bounds panic in TPM attestation
- GO-2026-4775 - step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates
- GO-2025-4181 - step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates