OpenPubkey Library Signature Verification Bypass Vulnerability

A vulnerability exists in the OpenPubkey library in versions prior to 0.10.0, allowing a specially crafted JSON Web Signature (JWS) to bypass signature verification. This issue also affects OPKSSH versions prior to 0.5.0, as OPKSSH relies on the OpenPubkey library for authentication. Exploiting this vulnerability could enable an attacker to bypass authentication in OPKSSH.

Impact

Bypassing authentication in OPKSSH, which could allow unauthorized access to systems or services that rely on OPKSSH for authentication via OpenID Connect identities.