What is the CVSS score of CVE-2025-6547?

CVE-2025-6547 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2025-6547?

Within 24 hours: Identify all systems and applications using pbkdf2 ≤3.1.2 through dependency scanning and inventory analysis; assess exposure by determining if pbkdf2 is used for authentication or signature validation. Within 7 days: Implement compensating controls such as disabling pbkdf2-based signature verification where possible, enforcing additional authentication factors, and applying WAF rules to detect signature manipulation attempts; isolate affected systems from critical infrastructure if feasible. Within 30 days: Monitor vendor channels for patch release and establish expedited patch deployment plan; conduct security audit of systems that processed authenticated requests during vulnerability window to identify potential compromises.

Red Hat CVE-2025-6547

Q: Which versions of Red Hat are affected by CVE-2025-6547?

A critical vulnerability in pbkdf2 (CVE-2025-6547) enables attackers to forge signatures by bypassing cryptographic validation, potentially allowing unauthorized access to systems and data that rely…. A patch is available.

EUVD-2025-28751 CRITICAL

Improper Input Validation (CWE-20)

2025-06-23 7ffcee3d-2c14-4c3e-b844-86c6a321a158

GHSA-v62p-rq8g-8h59

Authentication Bypass Red Hat Suse

Critical

Disputed · 9.1 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Impact	The CVSS v4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) indicates network-accessible attack surface with high complexity and requires attacker preparation, but no privileges or user interaction needed. The high integrity impact (VI:H) and signature integrity compromise (SI:H) are particularly severe—signature spoofing directly undermines non-repudiation and authentication mechanisms. Critically, the attack complexity is 'H' (high) and requires preparation (AT:P), which substantially lowers real-world exploitability despite the 9.1 CVSS score. The focus on signature validation rather than core cryptography suggests this may be exploitable only under specific configurations or application patterns. Real-world risk depends heavily on KEV/CISA status and POC availability (not provided in available data), but the high-complexity requirement suggests this is lower priority than CVSS alone would indicate. Organizations using pbkdf2 primarily for password hashing (standard use case) may face lower immediate risk than those using it for signature verification in non-standard implementations.
Exploit ScenarioDerived	An attacker identifies an application using vulnerable pbkdf2 ≤3.1.2 for signature verification. Through network access (AV:N), the attacker crafts malicious input with improperly validated parameters that cause the signature verification function to accept forged signatures. For example: (1) attacker intercepts or crafts a message; (2) attacker forges a signature using knowledge of the validation bypass; (3) attacker submits the malicious message+signature pair to the application; (4) due to improper input validation in pbkdf2's signature check, the forged signature is accepted as valid. The attack requires preparation (AT:P) to understand the specific validation bypass mechanism, explaining the high complexity (AC:H). In real-world scenarios, this could compromise API authentication, document signing verification, or any system relying on pbkdf2-derived keys for HMAC/signature operations. Likelihood of active exploitation is unclear without KEV status confirmation, but signature spoofing vulnerabilities are historically high-value targets for attackers.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

CVE-2025-6547 is an improper input validation vulnerability in the pbkdf2 cryptographic library (versions ≤3.1.2) that allows attackers to spoof cryptographic signatures through inadequate validation mechanisms. This affects any application using vulnerable pbkdf2 versions for password hashing or key derivation, potentially compromising authentication and integrity verification. With a CVSS score of 9.1 and high integrity/signature impact ratings, this vulnerability has significant real-world implications for systems relying on pbkdf2 for security-critical operations.

RemediationAI

action: Upgrade pbkdf2 library; target_version: >3.1.2; details: Immediate patching is required. Update to the latest stable version of pbkdf2 from the official repository or package manager (npm, pip, etc. depending on language/framework).
action: Validate input sanitization; details: Implement strict input validation at the application layer for all cryptographic operations, particularly signature verification and key derivation parameters. Do not rely solely on library input handling.
action: Implement cryptographic key rotation; details: If signature spoofing has occurred, rotate all cryptographic keys and re-verify integrity of signed data generated during the vulnerable period.
action: Audit signature verification logic; details: Review application code using pbkdf2 for signature operations. Ensure proper constant-time comparison and complete validation of all signature parameters.
action: Monitor for exploitation; details: Check security logs and audit trails for suspicious signature validation failures, unexpected authentication bypasses, or tampered data integrity checks during periods when vulnerable pbkdf2 versions were in use.

Affected Packages

npm pbkdf2 fix: 3.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

PBKDF2 (Password-Based Key Derivation Function 2) is a standardized key derivation function defined in RFC 2898, commonly used for password hashing and cryptographic key generation. The vulnerability stems from CWE-20 (Improper Input Validation), indicating that the library fails to properly validate inputs before processing them in cryptographic operations. This inadequate validation allows attackers to manipulate input parameters or bypass verification checks, leading to signature spoofing—a critical failure where an attacker can forge valid-appearing signatures without possessing the correct cryptographic key. The affected CPE scope includes pbkdf2 library implementations through version 3.1.2. The vulnerability appears in the signature validation logic rather than the core key derivation algorithm itself, suggesting the issue lies in how derived keys are verified or how signature operations handle their inputs.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY 9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Ubuntu MEDIUM

SUSE 7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat 8.1 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jun 23, 2025 - 19:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

Executive ViewAI

Why It Matters

A critical vulnerability in pbkdf2 (CVE-2025-6547) enables attackers to forge signatures by bypassing cryptographic validation, potentially allowing unauthorized access to systems and data that rely on this library for authentication or integrity verification. Organizations using affected versions (≤3.1.2) face immediate risk of authentication bypass and account compromise until mitigation is implemented.

Business Impact: Severe

Compensating Controls

Disable pbkdf2-based signature verification if functionally possible; enforce multi-factor authentication to add compensating security layers; implement network segmentation to limit lateral movement from compromised accounts; deploy WAF rules to detect anomalous signature patterns; enable enhanced logging and monitoring for authentication events; consider rate-limiting on authentication endpoints; isolate affected systems from production environment if operationally feasible; monitor vendor advisory channels daily for patch availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

Ubuntu

Priority: Medium

node-pbkdf2

Release	Status	Version
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

node-pbkdf2

Release	Status	Fixed Version	Urgency
bullseye	fixed	3.1.1-1	-
bookworm, trixie	fixed	3.1.2-3	-
forky, sid	fixed	3.1.5+~3.1.2-1	-
(unstable)	not-affected	-	-

SUSE

Severity: High

Product	Status
Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAPCAL-EC2	Affected
Image SLES15-SP5-Manager-Server-5-0-EC2-llc Image SLES15-SP5-Manager-Server-5-0-EC2-ltd	Affected
Image SLES15-SP5-Manager-Server-5-0 Image SLES15-SP5-Manager-Server-5-0-Azure-llc Image SLES15-SP5-Manager-Server-5-0-Azure-ltd	Affected
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP6	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2025:10738 ADVISORY https://access.redhat.com/errata/RHSA-2025:14474 ADVISORY https://access.redhat.com/errata/RHSA-2025:22905 ADVISORY https://access.redhat.com/errata/RHSA-2026:3710 ADVISORY https://access.redhat.com/errata/RHSA-2026:3712 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6547 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3744/ REF https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb REF https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back