The defect is a null‑signature bypass in the PKIAuthenticationModule.authenticate() method, allowing any user who possesses a certificate signed by a trusted certificate authority to authenticate as a different user. The attacker can then elevate privileges, tamper with repository access controls, exfiltrate shared reverse‑engineering data, and undermine overall server integrity. The weakness is categorized as CWE‑347, reflecting insecure reuse of authentication credentials.

The issue arises in Ghidra releases prior to version 12.1 distributed by the National Security Agency. Any installation of Ghidra before this release that uses PKI-based authentication is vulnerable; this includes both community and enterprise deployments.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, but the potential impact is significant. An attacker only needs a valid CA‑signed certificate and can construct a request with a null signature to bypass authentication; the attack can be conducted remotely over the network. The likelihood of exploitation is uncertain, yet the high impact warrants immediate attention.