What is the CVSS score of EUVD-2025-18922?

EUVD-2025-18922 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate EUVD-2025-18922?

Within 24 hours: Identify all systems and applications using pbkdf2 versions 3.0.10-3.1.2 through dependency scanning and inventory review. Escalate to development and DevOps teams for emergency patching coordination. Within 7 days: Implement compensating controls listed below and conduct security testing of affected systems. Within 30 days: Deploy vendor patch or upgrade to patched version (>3.1.2 or <3.0.10) and validate remediation through penetration testing.

Red Hat EUVD-2025-18922

Q: Which versions of Red Hat are affected by EUVD-2025-18922?

CVE-2025-6545 is a critical vulnerability in the pbkdf2 cryptographic library that enables attackers to forge digital signatures by bypassing input validation controls.. A patch is available.

| CVE-2025-6545 CRITICAL

Improper Input Validation (CWE-20)

2025-06-23 7ffcee3d-2c14-4c3e-b844-86c6a321a158

GHSA-h7cp-r72f-jxh6

Information Disclosure Red Hat Suse

Critical

Disputed · 9.1 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H) indicates network-accessible attack surface with low complexity but requires passing an attack pre-condition (AT:P), suggesting the attacker must satisfy specific conditions before exploitation. The high integrity impact (VI:H) with high scope impact (SI:H) reflects the signature spoofing capability—a critical threat to authentication systems. While CVSS score of 9.1 is severe, the AT:P modifier (attack pre-condition) and lack of availability impact (VA:N) suggest this is not a complete system compromise vector. Real-world priority requires assessment of: (1) whether KEV/CISA status indicates active exploitation, (2) proof-of-concept availability, and (3) EPSS score for exploitation probability. Organizations using pbkdf2 for cryptographic signature validation in authentication flows face critical risk; those using it only for password hashing face lower immediate risk. The signature spoofing capability is a high-integrity threat requiring immediate patching.
Exploit ScenarioDerived	An attacker sends a specially crafted HTTP request to a web application using pbkdf2 for JWT or OAuth signature validation. The request contains a malformed signature that bypasses the improper validation in lib/to-buffer.js, allowing the attacker to impersonate a legitimate user without possessing the correct cryptographic key. For example: attacker crafts a JWT token with an invalid signature field that, when passed through the vulnerable pbkdf2 validation logic, is incorrectly accepted as valid due to insufficient input sanitization. This enables account takeover, privilege escalation, or unauthorized API access. Attack complexity is low (network-based, no special tools required), but the attack pre-condition (AT:P) suggests the attacker must first understand the application's pbkdf2 usage pattern or the specific input format expected by the vulnerable code path. If a proof-of-concept exists demonstrating bypass techniques, real-world risk is significantly elevated.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

CVE-2025-6545 is an improper input validation vulnerability in the pbkdf2 library (versions 3.0.10 through 3.1.2) affecting the lib/to-buffer.js file that enables signature spoofing through inadequate validation mechanisms. Attackers with network access and minimal attack complexity can compromise the integrity of PBKDF2-derived cryptographic signatures, potentially allowing unauthorized authentication or data tampering. The high CVSS score of 9.1 reflects critical integrity and scope impacts, though real-world exploitation likelihood depends on confirmation of active exploitation and proof-of-concept availability.

RemediationAI

Immediate action: Update pbkdf2 to version 3.1.3 or later (post-patch version presumed available based on vulnerability disclosure). For npm-based projects: execute 'npm update pbkdf2' or specify '^3.1.3' in package.json and run 'npm install'. For yarn users: 'yarn upgrade pbkdf2@^3.1.3'. Verify the patch addresses lib/to-buffer.js input validation by reviewing the changelog or vendor advisory. Temporary mitigation if patching is delayed: implement additional input validation upstream of PBKDF2 calls, validate signature inputs against expected format before processing, or implement signature verification via alternate cryptographic libraries pending patch availability. Organizations should audit recent authentication logs for potential signature spoofing (failed or anomalous authentication attempts) if compromise window is unknown.

Affected Packages

npm pbkdf2 fix: 3.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

PBKDF2 (Password-Based Key Derivation Function 2) is a widely-used cryptographic key derivation function standardized in RFC 2898, commonly employed in password hashing and signature generation workflows. The vulnerability resides in lib/to-buffer.js, which handles input conversion to buffer format—a critical preprocessing step before cryptographic operations. The root cause is CWE-20 (Improper Input Validation), indicating that the library fails to properly validate or sanitize input data before processing it through the PBKDF2 algorithm. This allows an attacker to craft malformed or unexpected input that bypasses validation checks, leading to signature spoofing where invalid signatures are accepted as legitimate. The affected CPE scope includes pbkdf2 package versions 3.0.10 through 3.1.2, commonly deployed in Node.js environments and web authentication systems.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY 9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Ubuntu MEDIUM

SUSE 7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat 8.1 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jun 23, 2025 - 19:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

Executive ViewAI

Why It Matters

CVE-2025-6545 is a critical vulnerability in the pbkdf2 cryptographic library that enables attackers to forge digital signatures by bypassing input validation controls. Organizations using affected versions (3.0.10-3.1.2) face immediate risk of authentication bypass and data integrity compromise, particularly in applications relying on pbkdf2 for password hashing or signature verification.

Business Impact: Severe

Compensating Controls

No vendor patch currently available. Implement immediate compensating controls: (1) Isolate affected systems from untrusted network segments using network segmentation; (2) Disable signature verification features if operationally feasible; (3) Implement WAF rules to detect and block requests with suspicious signature patterns; (4) Deploy enhanced monitoring and alerting for authentication anomalies; (5) Enforce multi-factor authentication on critical accounts; (6) Consider code-level workarounds if pbkdf2 usage is limited to specific functions. Monitor vendor advisories closely for patch availability.

Threat Intelligence Overview

EPSS Score

0.1%

Top 68% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Ubuntu

Priority: Medium

node-pbkdf2

Release	Status	Version
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-

Debian

Bug #1108283

node-pbkdf2

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	3.1.1-1	-
bookworm, trixie	vulnerable	3.1.2-3	-
forky, sid	fixed	3.1.5+~3.1.2-1	-
(unstable)	fixed	3.1.3+~3.1.2-1	-

SUSE

Severity: High

Product	Status
Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-SAP Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-EC2 Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAPCAL-EC2	Affected
Image SLES15-SP5-Manager-Server-5-0-EC2-llc Image SLES15-SP5-Manager-Server-5-0-EC2-ltd	Affected
Image SLES15-SP5-Manager-Server-5-0 Image SLES15-SP5-Manager-Server-5-0-Azure-llc Image SLES15-SP5-Manager-Server-5-0-Azure-ltd	Affected
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP6	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2025:10738 ADVISORY https://access.redhat.com/errata/RHSA-2025:14090 ADVISORY https://access.redhat.com/errata/RHSA-2025:14474 ADVISORY https://access.redhat.com/errata/RHSA-2025:22905 ADVISORY https://access.redhat.com/errata/RHSA-2026:3710 ADVISORY https://access.redhat.com/errata/RHSA-2026:3712 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6545 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3744/ REF https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078 REF https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb REF https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back