CVE-2026-52754

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1

Description An authentication bypass exists in the PKIAuthenticationModule.authenticate() function. This issue allows any user possessing a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Successful exploitation can lead to privilege escalation, modification of repository access controls, exfiltration of shared reverse engineering databases, and permanent compromise of server integrity.

Recommendations Update to version 12.1 or later. As a temporary workaround, restrict the use of the PKIAuthenticationModule.authenticate() function until the update is applied.