Threats affecting pkg:github/lfdt-lockness/cggmp21

CVE-2025-66016 is a critical vulnerability in the LFDT-Lockness cggmp21 product, specifically versions prior to 0.6.3. The flaw stems from insufficient verification of data authenticity in the zero-knowledge (ZK) proof within the CGGMP24 ECDSA threshold signature scheme (TSS) protocol. This missing check allows a single malicious signer to reconstruct the entire private key, compromising the cryptographic security of the system. The vulnerability has a CVSS 4.0 score of 9.3, indicating high exploitability and severe impact without requiring authentication or user interaction. Although no known exploits are currently reported in the wild, the risk is significant due to the nature of the cryptographic key compromise. Mitigation requires upgrading to version 0.