An improper cryptographic signature verification vulnerability in the node-forge library allows unauthenticated attackers to bypass authentication and authorization logic.

The library fails to enforce canonical Ed25519 signature verification, permitting signatures where the scalar S is not properly reduced modulo the group order. This flaw allows unauthenticated actors to submit forged signatures that are accepted by the library but rejected by standards-compliant implementations.

The vulnerability presents a significant risk to application integrity and security controls. Because the flaw allows for signature malleability, attackers can potentially bypass authentication mechanisms, replay previously used signatures, or evade duplicate-signature tracking. With a CVSS score of 7.5, this high-severity issue necessitates immediate attention to prevent unauthorized access and potential data manipulation within systems relying on node-forge for security operations.

Immediate Action: Update the node-forge dependency to version 1.4.0 or later immediately to incorporate the corrected signature verification logic.

Proactive Monitoring: Review application logs for authentication failures or anomalies related to signature verification processes, particularly those involving Ed25519.

Compensating Controls: If immediate patching is not feasible, implement strict input validation at the application layer to reject non-canonical Ed25519 signatures, though updating remains the only robust solution.

Public Exploit Available: Unknown

Given the critical role of cryptographic libraries in maintaining system security, this vulnerability must be treated with high urgency. Organizations should audit their dependency trees to identify instances of node-forge and perform the mandatory update to version 1.4.0. Failure to address this flaw could lead to the total compromise of authentication and authorization workflows within the affected software.