bsv-blockchain ts-sdk 1.x improper following of specification by caller

Summaryinfo

A vulnerability, which was classified as problematic, has been found in bsv-blockchain ts-sdk 1.x. Affected by this issue is some unknown functionality. The manipulation leads to improper following of specification by caller. This vulnerability is referenced as CVE-2025-69287. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in bsv-blockchain ts-sdk 1.x. This issue affects an unknown functionality. The manipulation with an unknown input leads to a improper following of specification by caller vulnerability. Using CWE to declare the problem leads to CWE-573. The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform. Impacted is integrity, and availability. The summary by CVE is:

The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. The vulnerability was located in the `Peer.ts` file of the TypeScript SDK, specifically in the `processInitialRequest` and `processInitialResponse` methods where signature data is prepared for BRC-104 mutual authentication. The TypeScript SDK incorrectly prepared signature data by concatenating base64-encoded nonce strings (`message.initialNonce + sessionNonce`) then decoding the concatenated base64 string (`base64ToBytes(concatenatedString)`). This produced ~32-34 bytes of signature data instead of the correct 64 bytes. BRC-104 authentication relies on cryptographic signatures to establish mutual trust between peers. When signature data preparation is incorrect, signatures generated by the TypeScript SDK don't match those expected by Go/Python SDKs; cross-implementation authentication fails; and an attacker could potentially exploit this to bypass authentication checks. The fix in version 2.0.0 ensures all SDKs now produce identical cryptographic signatures, restoring proper mutual authentication across implementations.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-69287 since 12/31/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.0.0 eliminates this vulnerability. Applying the patch d8cf6930028372079d977138ae9eaa03ae2f50bb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• bsv-blockchain

Name

• ts-sdk

Version

• 1.x

License

• open-source

Website

• Product: https://github.com/bsv-blockchain/ts-sdk/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion