This flaw in Step CA allows an attacker to request and receive a new X.509 certificate via the SCEP UpdateReq message without any authentication. The vulnerability requires no credentials, enabling the creation of certificates that can carry any desired identity. By issuing such forged certificates, an adversary can impersonate authentic services, facilitating man‑in‑the‑middle or phishing attacks, and undermining TLS trust in the environment. Root causes include an authentication bypass (CWE‑287), unprotected use of certificate signing (CWE‑295), and insecure default configuration (CWE‑306).

The impacted software is smallstep certificates. Any installation of version 0.30.0‑rc6 or earlier is vulnerable. Version 0.30.0‑rc7 and later contain the fix, as released in the 0.30.0‑rc7 release cycle.

The CVSS score is 10, indicating the maximum possible severity. The EPSS score is below 1 %, suggesting that, although the vulnerability is severe, the likelihood of exploitation in the wild is currently low. It is not listed in the CISA KEV catalog. The likely attack vector is network‑based, targeting the SCEP endpoint through HTTP or HTTPS traffic. As authentication is not required, any party able to communicate with the SCEP interface can exploit this flaw. The impact is potentially system‑wide, as any certificate issued may be trusted by all services that rely on the certificate authority.