ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-54885

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication.

Published Aug 7, 2025 · catalog updated Aug 7, 2025 · Thinbus Javascript Secure Remote

Check this week

CVE-2025-54885 is not in CISA KEV. FIRST estimates a 39.00% chance of exploitation in the next 30 days. Check whether you run Thinbus Javascript Secure Remote.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Thinbus Javascript Secure Remote).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
39.00%
Remediation
Version ranges on file
Affected products
vendor simbo1905 thinbus-srp-npm < 2.0.1

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and passw

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor simbo1905 thinbus-srp-npm < 2.0.1< 2.0.1

How to fix CVE-2025-54885

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-54885 is not in CISA KEV. FIRST estimates a 39.00% chance of exploitation in the next 30 days. Check whether you run Thinbus Javascript Secure Remote.

Which versions are affected?

Compare what you have installed with simbo1905 thinbus-srp-npm < 2.0.1 < 2.0.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 39.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 7, 2025 · EUVD

    Detected

    Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the

  2. Aug 7, 2025 · EUVD

    Updated

    Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The client public value is being generated from a private value that is 4 bits below the

Sources

  • CVE.orgVulnerability recordCVE-2025-54885

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-23897

    Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Aug 7, 2025. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.