An error in the Ed25519 signature verification routine of tinyssh leads to improper verification of cryptographic signatures, enabling a local attacker to forge signatures and potentially bypass authentication or authorization checks that depend on these signatures. The flaw is a result of limited input validation and is identified as CWE-345 and CWE-347. The impact is restricted to the local environment and does not expose the system to remote attackers.

The vulnerability exists in janmojzis tinyssh versions up to 20250501, specifically in the crypto_sign_ed25519_tinyssh.c component. Upgrading to release 20260301 resolves the issue, as the patch commit 9c87269607e0d7d20174df742accc49c042cff17 has been applied to this version.

The CVSS score is 2, indicating low severity. The empirical probability of exploitation is unknown and the vulnerability is not listed in the CISA KEV catalog. It requires local execution and is considered difficult to exploit, although an exploit has been published. Risk is therefore limited to local privilege holders, but the flaw can still allow credential replay or unauthorized actions within the local host.