PT-2025-6252 · Unknown · Distribution

Evanebb · Published 2025-02-11 · Updated 2026-01-23 · CVE-2025-24976

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions: Distribution versions 3.0.0-beta.1 through 3.0.0-rc.2

Description: The issue lies in how the JSON web key (JWK) verification is performed. When a JSON web token (JWT) contains a JWK header without a certificate chain, the code only checks if the KeyID (kid) matches one of the trusted keys, but doesn't verify that the actual key material matches. This allows an attacker to inject an untrusted signing key in a JWT.

Recommendations: For versions 3.0.0-beta.1 through 3.0.0-rc.2, update to version 3.0.0-rc.3 or later, which includes the fix for the issue, available at commit 5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd. As a temporary workaround, consider disabling token authentication until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-24976

GHSA-PHW4-MC57-4HWC

GO-2025-3460

OPENSUSE-SU-2025:14889-1

Affected Products

Distribution

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24976.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24976 · Security Note
• https://osv.dev/vulnerability/GO-2025-3460 · Vendor Advisory
• https://github.com/distribution/distribution/commit/f4a500caf68169dccb0b54cb90523e68ee1ac2be · Note
• https://github.com/distribution/distribution/security/advisories/GHSA-phw4-mc57-4hwc · Note
• https://github.com/distribution/distribution/commit/5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd · Note
• https://suse.com/security/cve/CVE-2025-23388 · Note
• https://suse.com/security/cve/CVE-2025-27144 · Note
• https://suse.com/security/cve/CVE-2025-25199 · Note
• https://suse.com/security/cve/CVE-2025-27155 · Note
• https://twitter.com/CVEnew/status/1889348228094849521 · Twitter Post
• https://suse.com/security/cve/CVE-2025-23387 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note