Critical Step CA Flaw (CVE-2025-44005, CVSS 10.0) Allows Unauthenticated Bypass to Issue Fraudulent Certificates

A critical Step CA vulnerability (CVE-2025-44005, CVSS 10.0) has been identified in the Automated Certificate Management Environment (ACME) and Simple Certificate Enrollment Protocol (SCEP) provisioners used by Step CA, potentially allowing an unauthenticated attacker to bypass authorisation checks and issue fraudulent certificates or access restricted parts of the CA infrastructure.

The flaw, described as an “Authorization Bypass in ACME and SCEP Provisioners”, carries no evidence of active exploitation at present, and Smallstep Labs is withholding detailed technical information to give administrators time to patch. The issue was identified by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG), with a full technical write-up expected after deployments are secured.

Administrators are urged to upgrade to the latest release, v0.29.0, immediately to mitigate the vulnerability, according to the advisory GHSA-h8cp-697h-8c8p from Smallstep.