Vulnerability Description
Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise server integrity.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Ghidra | < 12.1 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/ghidra/commit/78729379e471bbb3d969409bPatch
- https://github.com/NationalSecurityAgency/ghidra/commit/79d8f164f8bb8b15cfb60c5dPatch
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-5wxq-7Vendor Advisory
- https://www.vulncheck.com/advisories/ghidra-authentication-bypass-via-null-signaThird Party Advisory
FAQ
What is CVE-2026-52754?
CVE-2026-52754 is a vulnerability with a CVSS score of 8.8 (HIGH). Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by prese...
How severe is CVE-2026-52754?
CVE-2026-52754 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-52754?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Ghidra.