Description (CNA)
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| smallstep / Step-CA | affected 0.28.4; affected v0.28.3 |
CWE
CWE-287
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2025-2242
- https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.