PT-2026-20262 · Unknown · Bsv Blockchain Sdk

Published 2026-02-17 · Updated 2026-02-18 · CVE-2025-69287

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions BSV Blockchain SDK versions prior to 2.0.0

Description A cryptographic issue exists in the BSV Blockchain SDK's BRC-104 authentication implementation. Specifically, incorrect signature data preparation in the Peer.ts file, within the processInitialRequest and processInitialResponse methods, leads to signature incompatibility between SDK implementations and potential authentication bypass. The SDK incorrectly concatenates base64-encoded nonce strings before decoding, resulting in approximately 32-34 bytes of signature data instead of the expected 64 bytes. This incompatibility prevents successful authentication when the TypeScript SDK interacts with Go or Python SDKs. The issue stems from the incorrect handling of base64 padding characters during decoding.

Recommendations Upgrade to version 2.0.0 or later to ensure correct cryptographic signature generation and restore proper mutual authentication across implementations.

Exploit

Fix

Weakness Enumeration

CWE-573

Related Identifiers

CVE-2025-69287

GHSA-VJPQ-XX5G-QVMM

Affected Products

Bsv Blockchain Sdk

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69287.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-69287 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjpq-xx5g-qvmm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69287 · Security Note
• https://github.com/bsv-blockchain/ts-sdk/security/advisories/GHSA-vjpq-xx5g-qvmm · Note
• https://github.com/bsv-blockchain/ts-sdk/commit/d8cf6930028372079d977138ae9eaa03ae2f50bb · Note
• https://github.com/bsv-blockchain/ts-sdk · Note
• https://twitter.com/CVEnew/status/2024258095111958609 · Twitter Post
• https://t.me/CVEtracker/45006 · Telegram Post