{"id":"CVE-2025-69287","summary":"BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability","details":"The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. The vulnerability was located in the `Peer.ts` file of the TypeScript SDK, specifically in the `processInitialRequest` and `processInitialResponse` methods where signature data is prepared for BRC-104 mutual authentication. The TypeScript SDK incorrectly prepared signature data by concatenating base64-encoded nonce strings (`message.initialNonce + sessionNonce`) then decoding the concatenated base64 string (`base64ToBytes(concatenatedString)`). This produced ~32-34 bytes of signature data instead of the correct 64 bytes. BRC-104 authentication relies on cryptographic signatures to establish mutual trust between peers. When signature data preparation is incorrect, signatures generated by the TypeScript SDK don't match those expected by Go/Python SDKs; cross-implementation authentication fails; and an attacker could potentially exploit this to bypass authentication checks. The fix in version 2.0.0 ensures all SDKs now produce identical cryptographic signatures, restoring proper mutual authentication across implementations.","aliases":["GHSA-vjpq-xx5g-qvmm"],"modified":"2026-08-12T03:51:22.216423767Z","published":"2026-02-18T18:42:22.893Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69287.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-573"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69287.json"},{"type":"ADVISORY","url":"https://github.com/bsv-blockchain/ts-sdk/security/advisories/GHSA-vjpq-xx5g-qvmm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69287"},{"type":"FIX","url":"https://github.com/bsv-blockchain/ts-sdk/commit/d8cf6930028372079d977138ae9eaa03ae2f50bb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bsv-blockchain/ts-sdk","events":[{"introduced":"0"},{"fixed":"d8cf6930028372079d977138ae9eaa03ae2f50bb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.0.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.0.21","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.6","v1.0.5","v1.0.4","v1.0.2","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69287.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}