CVE-2025-44005: 
Caddy vulnerability analysis and mitigation

CVE-2025-44005 is a critical authorization bypass vulnerability in Smallstep Step CA (the github.com/smallstep/certificates Go package) affecting deployments configured with ACME and/or SCEP provisioners. All versions up to and including v0.28.4 are affected; the issue was patched in v0.29.0. The vulnerability was discovered by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG) and disclosed on December 3, 2025. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Smallstep Advisory).

The root cause is improper authentication (CWE-287 / CWE-306: Missing Authentication for Critical Function) in how ACME and SCEP provisioners handled inbound tokens. Unlike other Step CA provisioners (e.g., JWK), ACME and SCEP define their own authorization mechanisms and are not designed to accept tokens. However, if a request presented a token that claimed to be issued for an ACME or SCEP provisioner, those provisioners accepted it without validating it, effectively treating the request as authenticated and bypassing the protocol's own authorization checks. The fix in v0.29.0 updates ACME and SCEP provisioners to explicitly reject any request that provides a token, and updates GetTokenID to return ErrTokenFlowNotSupported for these provisioner types (Smallstep Advisory, Fix Commit). Authorization webhooks and regular CA policies (allowed names, certificate validity restrictions) remain enforced even in the vulnerable versions.

A remote, unauthenticated attacker can force a vulnerable Step CA instance to issue X.509 certificates without completing the required ACME or SCEP protocol authorization steps, resulting in fraudulent certificate creation. This has high confidentiality and integrity impact with a changed scope, meaning the compromise extends beyond the CA itself to all systems and services that trust certificates issued by the affected CA. Fraudulently issued certificates could be used for man-in-the-middle attacks, impersonation of internal services, lateral movement within a PKI-protected environment, or bypassing mutual TLS authentication (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability was identified during a security review and disclosed through coordinated disclosure; detailed technical information was initially withheld during the embargo window. The EPSS score is approximately 0.029% (9th percentile), indicating a currently low probability of near-term exploitation (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog. The issue was reported by Cisco ASIG researcher Stephen Kubik (Smallstep Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Step CA instances running version v0.28.4 or earlier with ACME or SCEP provisioners enabled. This can be done by querying the CA's discovery endpoint (e.g., /.well-known/acme-challenge or SCEP endpoints) or by reviewing exposed service banners.
2. Craft a malicious token: Construct a JWT or similar token that claims to be issued for the target ACME or SCEP provisioner (e.g., with the audience set to acme/<provisioner-name>). The token does not need to be cryptographically valid for the provisioner's own protocol checks, only for the CA's token-acceptance logic.
3. Submit request to /sign endpoint: Send an HTTP request to the Step CA /sign endpoint (or equivalent certificate issuance endpoint), including the crafted token in the Authorization header, bypassing the ACME/SCEP protocol's own challenge-response authorization flow.
4. Receive fraudulent certificate: Because the ACME or SCEP provisioner accepted the token without validating it, the CA treats the request as authenticated and issues the requested X.509 certificate without the attacker completing the required protocol challenges.
5. Leverage issued certificate: Use the fraudulently obtained certificate for impersonation, mTLS bypass, or man-in-the-middle attacks against services that trust the compromised CA (Smallstep Advisory, Fix Commit).

• Network: Unexpected or anomalous HTTP POST requests to the Step CA /sign endpoint originating from clients that are not part of the expected ACME or SCEP enrollment workflow; requests bearing an Authorization Bearer token to ACME/SCEP provisioner endpoints.
• Logs: Step CA audit logs showing certificate issuance events attributed to ACME or SCEP provisioners where no corresponding ACME challenge completion or SCEP transaction is recorded; tokens with audience values matching acme/<provisioner-name> appearing in sign request logs.
• File System / Database: Unexpected certificates in the CA's issued certificate database with subject names or SANs not matching any known enrollment request; certificates issued outside of normal enrollment windows.
• Process: Unusual spikes in certificate issuance volume from ACME or SCEP provisioners without corresponding ACME order or SCEP transaction records (Smallstep Advisory).

Operators should upgrade Step CA to v0.29.0 or later immediately, as this version blocks ACME and SCEP provisioners from accepting any token-based requests (GitHub Advisory). As a temporary workaround for those unable to upgrade, access to the /sign endpoint should be blocked at the network or firewall level to prevent exploitation (Smallstep Advisory). After upgrading, operators should review issued certificates for any anomalous issuance and audit ACME/SCEP provisioner configurations. Organizations running Step CA in production can request inclusion on Smallstep's embargo list for advance notification of future security updates at https://u.step.sm/disclosure.

The vulnerability was discovered and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG), and Cisco Talos published a vulnerability report (TALOS-2025-2242) and a blog post covering the issue alongside other vulnerabilities (Talos Blog). Security news outlets including SecurityOnline.info and The Hacker Wire covered the disclosure, highlighting the CVSS 10.0 score and the potential for unauthenticated certificate forgery (The Hacker Wire). The vulnerability was also included in CISA's weekly vulnerability bulletin for the week of December 15, 2025. Community reaction on social media (Bluesky) noted the severity of the flaw given Step CA's role in PKI infrastructure.