Unrated severityOSV Advisory· Published Jan 10, 2026· Updated Jan 12, 2026
Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
CVE-2025-62235
Description
Authentication Bypass by Spoofing vulnerability in Apache NimBLE.
Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. This issue affects Apache NimBLE: through 1.8.0.
Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Affected products
2- Range: nimble_1_5_0_rc1_tag, nimble_1_5_0_tag, nimble_1_6_0_rc1_tag, …
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.