What is the CVSS score of CVE-2025-66406?

CVE-2025-66406 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Red Hat are affected by CVE-2025-66406?

Organizations using Step CA should be aware of moderate risk from CVE-2025-66406, a incorrect authorization vulnerability rated CVSS 5.0. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2025-66406?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Red Hat CVE-2025-66406

EUVD-2025-201014 MEDIUM

Incorrect Authorization (CWE-863)

2025-12-03 security-advisories@github.com

GHSA-j7c9-79x7-8hpr

Authentication Bypass Red Hat Suse

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

SUSE

3.1 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Red Hat

5.0 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2025-201014

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

CVE Published

Dec 03, 2025 - 20:16 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.