PT-2026-89245

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The module allows a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. It employs cryptographic constructions that...

Cryptographic Weakness

thinbus-srp is vulnerable to cryptographic weakness. The vulnerability is due to a protocol compliance bug where the client generates only 252 bits of entropy instead of the intended 2048 bits, which allows an attacker to exploit the reduced security margin and potentially break the authenticatio...

CVE-2025-54885

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime defaulted t...

GHSA-8Q6V-474H-WHGG The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended

Impact A protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime defaulted to 2048 bits. RFC 5054 states in section 2.5.4 Client Key Exchange The client key exchange message...

New Attack Against AES-256 a 'Huge Result'

A group of cryptographers has devised a new attack against AES, the de facto standard encryption algorithm, that enables them to recover an encryption key in far less time than had been possible before. The attack can recover an AES-256 key in a small enough amount of time to make the method...