An error in the Ed25519 signature verification routine of tinyssh leads to improper verification of cryptographic signatures. Based on the description, it is inferred that this flaw could allow a local attacker to forge signatures and potentially bypass authentication or authorization checks that depend on these signatures. Based on the description, it is inferred that the flaw is a result of limited input validation and is identified as CWE-345 and CWE-347. The impact is restricted to the local environment and does not expose the system to remote attackers. The vulnerability exists in an unknown function within the crypto_sign_ed25519_tinyssh.c component of TinySSH releases up to 20250501. Attackers must manipulate input locally; the attack has a high complexity rating and is considered difficult to exploit, yet an exploit has been published and may be used by local users.

The vulnerability exists in janmojzis tinyssh versions up to 20250501, specifically in the crypto_sign_ed25519_tinyssh.c component. Upgrading to release 20260301 resolves the issue, as the patch commit 9c87269607e0d7d20174df742accc49c042cff17 has been applied to this version.

The CVSS score is 2, indicating low severity. The empirical probability of exploitation is low, with an EPSS score of < 1%, and the vulnerability is not listed in the CISA KEV catalog. It requires local execution and is considered difficult to exploit, although an exploit has been published. Risk is therefore limited to local privilege holders, but the flaw can still allow credential replay or unauthorized actions within the local host.