CVE-2025-54885 Details
Description
Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. This is fixed in version 2.0.1.
A protocol compliance vulnerability exists in Thinbus Javascript Secure Remote Password (SRP) browser implementation, specifically in versions prior to 2.0.1. The issue arises because the client generates a fixed 252 bits of entropy for the public key, instead of the required 2048 bits. This discrepancy is due to the client incorrectly using the BigInteger constructor function, leading to a private value that is 4 bits short of the specification. As a result, the protocol's security margin is compromised, making it practically exploitable. In contrast, the server correctly utilizes the full 2048 bits to create the shared session key and password proof.
Users can upgrade to Thinbus SRP version 2.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2025CISA-ADP
Assessed Aug 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/simbo1905/thinbus-srp-npm/issues/28 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/simbo1905/thinbus-srp-npm/pull/30/commits/4aeaea2366e090765a8204059c7bcf3616438d31 | [email protected] | Source CodeVendor |
| https://github.com/simbo1905/thinbus-srp-npm/security/advisories/GHSA-8q6v-474h-whgg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| simbo1905 thinbus-srp | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2025 | New CVE Received | [email protected] |