Cryptographic Vulnerability in BSV Blockchain SDK by BSV Blockchain

CVE-2025-69287

What is CVE-2025-69287?

The BSV Blockchain SDK experienced a cryptographic malfunction in its BRC-104 authentication protocol, primarily affecting versions prior to 2.0.0. This flaw was due to improper signature data preparation in the Peer.ts file, specifically within the processInitialRequest and processInitialResponse methods. The SDK incorrectly concatenated base64-encoded nonce strings, producing inadequate signature data that could lead to authentication failures. As a consequence, signatures generated were incompatible with expectations from other SDK implementations, such as those in Go and Python, allowing potential circumvention of authentication checks. The resolution implemented in version 2.0.0 guarantees that all SDK versions now produce consistent cryptographic signatures, reinstating proper mutual authentication across different implementations.

References