Is CVE-2025-54887 actively exploited?

No active exploitation of CVE-2025-54887 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-54887 be exploited remotely?

Yes. CVE-2025-54887 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-54887?

CVE-2025-54887 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2025-54887

CRITICAL

CVE-2025-54887

CWE-354Published: August 8, 2025· Updated: Jun 17, 2026

9.1

CVSS v3.1

Official Description

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.

NVD Source

Technical Analysis

CVE-2025-54887 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.