CVE-2025-44005

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

More information : https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p