CVE-2025-69287
Cryptographic Signature Flaw in BSV SDK Enables Authentication Bypass
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bsv | blockchain_sdk | to 2.0.0 (exc) |
| bsv | sdk | 2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-573 | The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability exists in the BSV Blockchain TypeScript SDK's implementation of BRC-104 mutual authentication. The issue arises from how the SDK prepares signature data by incorrectly concatenating two base64-encoded nonce strings before decoding them. This causes the base64 decoder to stop prematurely at padding characters, resulting in truncated signature data (~32-34 bytes instead of the correct 64 bytes). Because of this, the signatures generated by the TypeScript SDK do not match those from other SDKs like Go or Python, leading to authentication failures and potential bypass of authentication checks."}, {'type': 'paragraph', 'content': 'The root cause is improper handling of base64 padding during concatenation and decoding of nonce values. The fix involves decoding each nonce separately from base64 to bytes and then concatenating the byte arrays, ensuring correct signature data length and compatibility across SDK implementations.'}] [1, 2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can lead to authentication bypass scenarios in applications using the affected TypeScript SDK for BRC-104 mutual authentication. Because the signature data is incorrectly prepared, the SDK's signatures are incompatible with other SDKs, causing cross-implementation authentication failures."}, {'type': 'paragraph', 'content': 'An attacker could exploit this flaw to bypass authentication checks, potentially gaining unauthorized access to systems or data that rely on this mutual authentication mechanism. This could compromise the security of applications built on the BSV Blockchain using the vulnerable SDK versions prior to 2.0.0.'}] [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying mismatches or failures in BRC-104 mutual authentication between TypeScript SDK clients and Go/Python SDK servers due to incorrect signature data preparation.
One approach is to monitor authentication logs for repeated authentication failures or unexpected bypasses when TypeScript SDK clients interact with other SDK implementations.
Since the vulnerability is related to signature data preparation in the SDK, network detection could involve capturing and analyzing authentication messages to verify if the signature data length is approximately 32-34 bytes instead of the expected 64 bytes.
Commands to assist detection might include using packet capture tools like tcpdump or Wireshark to capture authentication traffic, then extracting and decoding the signature fields to check their length and format.
- tcpdump -i <interface> -w capture.pcap port <authentication_port>
- Use Wireshark to filter and inspect BRC-104 authentication packets, focusing on signature data fields.
- Write or use scripts to decode base64 signature data from captured packets and verify if the signature byte length matches the expected 64 bytes.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the BSV Blockchain TypeScript SDK to version 2.0.0 or later, where the vulnerability has been fixed.
The fix involves correctly decoding each base64-encoded nonce separately before concatenating their byte arrays for signature generation, ensuring consistent and secure mutual authentication.
Until the upgrade is applied, avoid using vulnerable versions of the SDK in production environments, especially in cross-implementation authentication scenarios involving Go or Python SDKs.
Additionally, review authentication logs for suspicious activity that might indicate exploitation attempts and consider implementing additional monitoring or access controls to limit exposure.