CVE-2025-54885

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-54885

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54885.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-54885

Aliases

GHSA-8q6v-474h-whgg

Published

2025-08-07T00:02:42.612Z

Modified

2025-12-05T10:19:57.700693Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits

Details

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. This is fixed in version 2.0.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54885.json",
    "cwe_ids": [
        "CWE-331"
    ]
}

References

Affected packages

Git / github.com/simbo1905/thinbus-srp-npm

Affected ranges

Type

GIT

Repo

https://github.com/simbo1905/thinbus-srp-npm

Events

Introduced

Fixed

a7dcbbd989c44d6b647012e183281879646a4206

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.1"
        }
    ]
}

Affected versions

1.*

1.5.3

1.6.0

1.7.0

1.7.1

1.7.2

1.7.4

1.7.5

1.8.0