AIKIDO-2026-747353

web-auth/cose-lib is vulnerable to Private Key Recovery

Private Key RecoveryGHSA-h7p4-6f74-7w4g Published 2 days ago

Medium Risk

This Affects:

web-auth/cose-lib

2.1.0 - 4.7.1

Fixed in 4.7.2

Are you affected? Scan for Free

TL;DR

EdDSA::sign() builds the libsodium signing key by concatenating the caller-supplied private seed with a caller-supplied public key, without checking that the public key is the one derived from the seed. An observer of two signatures over the same message produced with the same seed but different public halves recovers the long-term private scalar through modular arithmetic, and missing length validation lets malformed keys reach the signing call. This exposes the Ed25519 private key to a party able to influence the public key passed to signing. The fix derives the key pair from the seed alone and rejects a supplied public key that does not match the derived value.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you call EdDSA::sign() with a public key supplied separately from the private seed.