EUVD-2026-36013Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise server integrity.
AnalysisAI
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to impersonate arbitrary users by submitting their public certificate alongside a null signature to PKIAuthenticationModule.authenticate(). Successful exploitation yields privilege escalation, tampering of repository access controls, exfiltration of shared reverse-engineering databases, and persistent compromise of the Ghidra server. No public exploit identified at time of analysis, but a vendor patch and detailed advisory from VulnCheck are available.
Technical ContextAI
Ghidra is the National Security Agency's open-source software reverse-engineering suite, which supports collaborative analysis through a server component (including BSim) that authenticates clients via PKI. The vulnerable PKIAuthenticationModule.authenticate() routine accepted a presented X.509 client certificate without enforcing verification of the accompanying cryptographic signature, accepting a null signature as valid. This maps directly to CWE-347 (Improper Verification of Cryptographic Signature): the server trusts identity claims encoded in the certificate Subject without proving the client actually possesses the corresponding private key, collapsing PKI authentication into mere certificate disclosure. The affected component (cpe:2.3:a:nationalsecurityagency:ghidra) is the Ghidra application itself, with the fix landing in commits 78729379 and 79d8f164 ahead of the 12.1 release.
RemediationAI
Vendor-released patch: upgrade to Ghidra 12.1 or later, which incorporates fixes from commits 78729379e471bbb3d969409be6a8c3d24af84220 and 79d8f164f8bb8b15cfb60c5d4faeb8e1c25d15ca that enforce proper signature verification in PKIAuthenticationModule.authenticate(). Where immediate upgrade is not possible, restrict network reachability of the Ghidra server to a trusted management VLAN or VPN, tighten the CA trust store so only a narrowly-scoped internal CA can issue client certificates accepted by the server (reducing the pool of attackers who can satisfy PR:L), and audit existing repository ACLs and recent admin actions for tampering before patching since the flaw permits persistent compromise. Note that network restrictions do not stop insiders with valid certs and tightening the CA may require reissuing legitimate user certificates. Full details: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-5wxq-7qpv-65p2.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today