A flaw in libp2p Gossipsub’s StrictSign policy allowed a malicious actor to sign a message with their own key and supply an attacker‑controlled key while claiming the message originated from a victim RSA peer ID. Because the policy did not bind the provided key to the claimed author when the RSA peer ID lacked an inlined public key, the message was treated as authentic and propagated. This vulnerability arises from a lack of authentication binding (CWE‑345) and from allowing an attacker to use a different key for signature verification (CWE‑347). As a result, applications that rely on the message’s from field for authorization, accounting, reputation, or audit logging could accept attacker‑controlled data as though it had come from a trusted peer.

The vulnerability affects the JavaScript implementation of libp2p, specifically the js‑libp2p package’s Gossipsub library, from version 15.0.0 up through 16.0.5. Any deployment of libp2p:js‑libp2p using the default StrictSign policy during this version range is impacted.

The CVSS score of 7.5 indicates a high severity level, and the vulnerability is exploitable by an unauthenticated network attacker. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. This flaw permits credential spoofing that can compromise critical operations performed by client applications. The attack requires no privileged access and can be performed remotely by sending a crafted Gossipsub message to a target node.