{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/distribution/distribution","cve_ids":["CVE-2025-24976"],"ecosystem":"Go","epss":0.00353,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-phw4-mc57-4hwc","id":"tcs_01M5KG71FAFF8V21HVW5GBHXCT","modified_at":"2026-02-04T02:22:56.136310Z","published_at":"2025-03-03T19:22:09Z","references":["https://osv.dev/vulnerability/GO-2025-3460","https://github.com/distribution/distribution/security/advisories/GHSA-phw4-mc57-4hwc","https://nvd.nist.gov/vuln/detail/CVE-2025-24976","https://github.com/distribution/distribution/commit/5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GO-2025-3460","url":"https://osv.dev/vulnerability/GO-2025-3460"},{"source":"nvd","source_id":"CVE-2025-24976","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24976"}],"summary":"Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution"}