Protocol Compliance Bug in Thinbus Javascript Secure Remote Password

CVE-2025-54885

What is CVE-2025-54885?

A protocol compliance issue in Thinbus Javascript Secure Remote Password versions 2.0.0 and below allows for the generation of a fixed 252 bits of entropy instead of the intended safe prime bit length of 2048 bits. This oversight results in a client public value derived from a private value that falls short of the specification by 4 bits. Consequently, the security margin of the protocol is diminished, leading to practical exploitability. The server utilizes its full-sized 2048-bit random number to create shared session keys and password proofs. This vulnerability is addressed in version 2.0.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References