CVE-2025-69287
Received Received - Intake
Cryptographic Signature Flaw in BSV SDK Enables Authentication Bypass

Publication date: 2026-02-18

Last updated on: 2026-02-18

Assigner: GitHub, Inc.

Description
The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. The vulnerability was located in the `Peer.ts` file of the TypeScript SDK, specifically in the `processInitialRequest` and `processInitialResponse` methods where signature data is prepared for BRC-104 mutual authentication. The TypeScript SDK incorrectly prepared signature data by concatenating base64-encoded nonce strings (`message.initialNonce + sessionNonce`) then decoding the concatenated base64 string (`base64ToBytes(concatenatedString)`). This produced ~32-34 bytes of signature data instead of the correct 64 bytes. BRC-104 authentication relies on cryptographic signatures to establish mutual trust between peers. When signature data preparation is incorrect, signatures generated by the TypeScript SDK don't match those expected by Go/Python SDKs; cross-implementation authentication fails; and an attacker could potentially exploit this to bypass authentication checks. The fix in version 2.0.0 ensures all SDKs now produce identical cryptographic signatures, restoring proper mutual authentication across implementations.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-18
Last Modified
2026-02-18
Generated
2026-05-06
AI Q&A
2026-02-18
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
bsv blockchain_sdk to 2.0.0 (exc)
bsv sdk 2.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-573 The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

[{'type': 'paragraph', 'content': "This vulnerability exists in the BSV Blockchain TypeScript SDK's implementation of BRC-104 mutual authentication. The issue arises from how the SDK prepares signature data by incorrectly concatenating two base64-encoded nonce strings before decoding them. This causes the base64 decoder to stop prematurely at padding characters, resulting in truncated signature data (~32-34 bytes instead of the correct 64 bytes). Because of this, the signatures generated by the TypeScript SDK do not match those from other SDKs like Go or Python, leading to authentication failures and potential bypass of authentication checks."}, {'type': 'paragraph', 'content': 'The root cause is improper handling of base64 padding during concatenation and decoding of nonce values. The fix involves decoding each nonce separately from base64 to bytes and then concatenating the byte arrays, ensuring correct signature data length and compatibility across SDK implementations.'}] [1, 2]


How can this vulnerability impact me? :

[{'type': 'paragraph', 'content': "This vulnerability can lead to authentication bypass scenarios in applications using the affected TypeScript SDK for BRC-104 mutual authentication. Because the signature data is incorrectly prepared, the SDK's signatures are incompatible with other SDKs, causing cross-implementation authentication failures."}, {'type': 'paragraph', 'content': 'An attacker could exploit this flaw to bypass authentication checks, potentially gaining unauthorized access to systems or data that rely on this mutual authentication mechanism. This could compromise the security of applications built on the BSV Blockchain using the vulnerable SDK versions prior to 2.0.0.'}] [2]


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection of this vulnerability involves identifying mismatches or failures in BRC-104 mutual authentication between TypeScript SDK clients and Go/Python SDK servers due to incorrect signature data preparation.

One approach is to monitor authentication logs for repeated authentication failures or unexpected bypasses when TypeScript SDK clients interact with other SDK implementations.

Since the vulnerability is related to signature data preparation in the SDK, network detection could involve capturing and analyzing authentication messages to verify if the signature data length is approximately 32-34 bytes instead of the expected 64 bytes.

Commands to assist detection might include using packet capture tools like tcpdump or Wireshark to capture authentication traffic, then extracting and decoding the signature fields to check their length and format.

  • tcpdump -i <interface> -w capture.pcap port <authentication_port>
  • Use Wireshark to filter and inspect BRC-104 authentication packets, focusing on signature data fields.
  • Write or use scripts to decode base64 signature data from captured packets and verify if the signature byte length matches the expected 64 bytes.

What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation step is to upgrade the BSV Blockchain TypeScript SDK to version 2.0.0 or later, where the vulnerability has been fixed.

The fix involves correctly decoding each base64-encoded nonce separately before concatenating their byte arrays for signature generation, ensuring consistent and secure mutual authentication.

Until the upgrade is applied, avoid using vulnerable versions of the SDK in production environments, especially in cross-implementation authentication scenarios involving Go or Python SDKs.

Additionally, review authentication logs for suspicious activity that might indicate exploitation attempts and consider implementing additional monitoring or access controls to limit exposure.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart