Medium severity5.0OSV Advisory· Published Dec 3, 2025· Updated Apr 15, 2026

CVE-2025-66406

Description

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/smallstep/certificatesGo	< 0.29.0	0.29.0

Affected products

Smallstep/CertificatesOSV
Range: v0.0.1-rc.2, v0.10.0, v0.11.0, …

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-j7c9-79x7-8hprghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-66406ghsaADVISORY
github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hprnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000