CVE-2025-69287: bsv-blockchain ts-sdk · Improper Following of Specification by Caller
Affects bsv-blockchain ts-sdkSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium : upgrade to 2.0.0 when convenient.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2.0.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 18 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade bsv-blockchain ts-sdk to 2.0.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| bsv-blockchaints-sdk | Affected
| Fixed in
|
AI-suggested
European organizations should immediately upgrade to version 2.0.0 or later of the BSV Blockchain TypeScript SDK to ensure correct signature generation and mutual authentication. In environments where immediate upgrade is not feasible, organizations should implement strict network segmentation and access controls around blockchain nodes to limit exposure to untrusted peers. Additionally, monitoring authentication logs for anomalies or repeated authentication failures can help detect exploitation attempts. Developers should audit any custom implementations of BRC-104 authentication to verify correct nonce handling and signature preparation. Employing cryptographic validation tests across SDK implementations before deployment can prevent interoperability issues. Finally, organizations should maintain up-to-date inventories of blockchain SDK versions in use and establish patch management processes specific to blockchain components.
Description
The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. The vulnerability was located in the `Peer.ts` file of the TypeScript SDK, specifically in the `processInitialRequest` and `processInitialResponse` methods where signature data is prepared for BRC-104 mutual authentication. The TypeScript SDK incorrectly prepared signature data by concatenating base64-encoded nonce strings (`message.initialNonce + sessionNonce`) then decoding the concatenated base64 string (`base64ToBytes(concatenatedString)`). This produced ~32-34 bytes of signature data instead of the correct 64 bytes. BRC-104 authentication relies on cryptographic signatures to establish mutual trust between peers. When signature data preparation is incorrect, signatures generated by the TypeScript SDK don't match those expected by Go/Python SDKs; cross-implementation authentication fails; and an attacker could potentially exploit this to bypass authentication checks. The fix in version 2.0.0 ensures all SDKs now produce identical cryptographic signatures, restoring proper mutual authentication across implementations.