CVE-2025-54885: Thinbus SRP Information Disclosure Flaw

CVE-2025-54885 Overview

CVE-2025-54885 affects Thinbus JavaScript Secure Remote Password (SRP), a browser-based SRP6a implementation used for zero-knowledge password authentication. In versions 2.0.0 and earlier, the client generates only 252 bits of entropy for its private value instead of matching the bit length of the safe prime, which defaults to 2048 bits. The client public value is therefore derived from a private value four bits below the specification. This weakens the protocol's designed security margin and makes brute-force recovery of the client secret practically feasible. The issue is fixed in version 2.0.1.

Critical Impact
Reduced client-side entropy in the SRP handshake shrinks the effective key space, enabling attackers to compromise session key material and password proofs derived from the weakened client secret.

Affected Products

Thinbus JavaScript SRP (thinbus-srp-npm) versions 2.0.0 and earlier
Applications using Thinbus SRP client for browser-based zero-knowledge authentication
Web systems that rely on Thinbus SRP for password proof exchange

Discovery Timeline

2025-08-07 - CVE-2025-54885 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54885

Vulnerability Analysis

The vulnerability is an insufficient randomness weakness classified under [CWE-331]. Thinbus SRP implements the SRP6a protocol, where the client selects a private random value a and derives a public value A = g^a mod N. The specification requires a to have entropy comparable to the bit length of the safe prime N. When N is 2048 bits, a should be similarly sized.

In Thinbus versions 2.0.0 and earlier, the client generates only 252 bits of entropy for a. This is four bits below the 256-bit floor commonly considered safe, and far below the 2048-bit specification default. The server continues to use a full-size 2048-bit random value, but the shared session key and password proof M1 are still derived from the weakened client secret.

Root Cause

The client-side random number generator produces a value with a fixed 252-bit length rather than sizing the output to the configured safe prime. This is a protocol compliance bug in how the private exponent is sampled before the modular exponentiation step. Because the shared session key K depends on both parties' contributions, weakness on either side reduces the overall security margin of the exchange.

Attack Vector

An attacker positioned to observe SRP exchange messages, or to interact with the authentication endpoint, can attempt to recover the client's private value through offline computation against the reduced key space. Successful recovery yields the shared session key and enables derivation of the password proof M1. The attack requires high complexity and cryptographic capability, but no privileges or user interaction. The vulnerability does not directly disclose the plaintext password verifier, but it undermines the zero-knowledge guarantee the protocol is designed to provide. Refer to the GitHub Security Advisory GHSA-8q6v-474h-whgg and the GitHub Issue Discussion for the maintainer's technical analysis.

Detection Methods for CVE-2025-54885

Indicators of Compromise

Client SRP public values A derived from private exponents shorter than the safe prime bit length
Authentication traffic originating from browser bundles pinned to thinbus-srp-npm versions at or below 2.0.0
Repeated SRP handshake attempts from a single source targeting the same account, consistent with offline analysis follow-up

Detection Strategies

Inventory front-end dependencies and identify deployments still shipping thinbus-srp-npm at or below version 2.0.0
Instrument the authentication service to log the bit length of received client public values A and alert on entries consistently below the expected prime size
Correlate anomalous SRP session failures with source IPs generating high volumes of authentication attempts

Monitoring Recommendations

Track npm and software composition analysis (SCA) reports for the thinbus-srp-npm package version across build pipelines
Monitor authentication logs for unusual patterns of session key negotiation failures or replay of A values
Alert on any client releases that regress to the vulnerable package version after upgrade

How to Mitigate CVE-2025-54885

Immediate Actions Required

Upgrade thinbus-srp-npm to version 2.0.1 or later across all client bundles and rebuild affected web applications
Force cache invalidation for any JavaScript assets containing the vulnerable client so end users load the patched code
Rotate long-lived session artifacts issued under the vulnerable client and require re-authentication for privileged accounts

Patch Information

The maintainer released the fix in version 2.0.1 of thinbus-srp-npm. The corrected implementation samples the client private value at the full bit length of the configured safe prime. Review the Pull Request Commits for the exact code change applied to the client random generation path.

Workarounds

If immediate upgrade is not feasible, layer additional server-side rate limiting on the SRP authentication endpoint to slow enumeration attempts
Enforce account lockout thresholds and require multi-factor authentication so password proof recovery alone does not grant access
Reduce the exposure of SRP handshake traffic to untrusted networks by tunneling authentication over mutually authenticated TLS where possible

bash

# Configuration example
npm install thinbus-srp@^2.0.1
npm ls thinbus-srp