CVE-2025-69287: BSV SDK Authentication Signature Data Preparation Vulnerability
Summary
CVE-2025-69287: BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability. Affects @bsv/sdk versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The BSV Blockchain SDK is a TypeScript library designed for building applications on the Bitcoin SV blockchain. It provides developers with tools for creating transactions, managing wallets, and interacting with the blockchain. However, a critical vulnerability has been identified in its BRC-104 authentication implementation, which can lead to authentication bypass and cross-implementation failures.
Vulnerability Detail
The vulnerability arises from incorrect preparation of signature data in the TypeScript SDK's BRC-104 authentication methods. Specifically, the processInitialRequest and processInitialResponse methods in the Peer.ts file concatenate base64-encoded nonce strings before decoding them. This results in signature data that is shorter than expected, leading to mismatches between SDK implementations and potential authentication bypass scenarios. The incorrect handling of base64 padding characters causes the base64 decoder to stop prematurely, producing only 32 bytes of signature data instead of the required 64 bytes.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
npm install @bsv/sdk@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround involves manually ensuring that the nonce strings are handled correctly in your implementation. Avoid concatenating base64 strings before decoding. Instead, decode each nonce separately and concatenate the resulting byte arrays.
Conclusion
The BSV SDK vulnerability (CVE-2025-69287) poses a significant risk to applications relying on BRC-104 authentication. It is crucial to update to the patched version 2.0.0 or later to mitigate the risk of authentication bypass and ensure compatibility across SDK implementations.
See every vulnerability recorded for @bsv/sdk →
FAQ
The vulnerability is a cryptographic signature verification bypass due to incorrect preparation of signature data in the BSV SDK.
The vulnerability can lead to authentication bypass, cross-implementation failures, and potential man-in-the-middle attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Regularly update your dependencies and monitor for vulnerabilities using tools like Vulert to ensure your application is secure.
