CVE-2025-53940

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-53940", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-14T17:23:35.262Z", "datePublished": "2025-07-24T22:23:58.389Z", "dateUpdated": "2025-07-25T13:30:36.230Z"}, "containers": {"cna": {"title": "Quiet uses insecure, inconsistent verification on local backend token", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67"}, {"name": "https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269", "tags": ["x_refsource_MISC"], "url": "https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269"}, {"name": "https://github.com/TryQuiet/quiet/pull/2928", "tags": ["x_refsource_MISC"], "url": "https://github.com/TryQuiet/quiet/pull/2928"}], "affected": [{"vendor": "TryQuiet", "product": "quiet", "versions": [{"version": "< 6.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-07-24T22:23:58.389Z"}, "descriptions": [{"lang": "en", "value": "Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1."}], "source": {"advisory": "GHSA-gpw8-w78h-xj67", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-25T13:30:29.993474Z", "id": "CVE-2025-53940", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-25T13:30:36.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-53940", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-25T13:30:29.993474Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-25T13:30:33.612Z"}}], "cna": {"title": "Quiet uses insecure, inconsistent verification on local backend token", "source": {"advisory": "GHSA-gpw8-w78h-xj67", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TryQuiet", "product": "quiet", "versions": [{"status": "affected", "version": "< 6.0.1"}]}], "references": [{"url": "https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67", "name": "https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269", "name": "https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TryQuiet/quiet/pull/2928", "name": "https://github.com/TryQuiet/quiet/pull/2928", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-07-24T22:23:58.389Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53940", "state": "PUBLISHED", "dateUpdated": "2025-07-25T13:30:36.230Z", "dateReserved": "2025-07-14T17:23:35.262Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-07-24T22:23:58.389Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "quiet", "vendor": "TryQuiet", "versions": [{"status": "affected", "version": "< 6.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1."}, {"lang": "es", "value": "Quiet es una alternativa a las aplicaciones de chat en equipo como Slack, Discord y Element, que no requiere confiar en un servidor central ni ejecutar uno propio. En las versiones 6.1.0-alpha.4 y anteriores, la API de Quiet para la comunicaci\u00f3n entre el backend y el frontend utilizaba una funci\u00f3n de comparaci\u00f3n insegura y no constante para la verificaci\u00f3n de tokens. Esto permit\u00eda un posible ataque de sincronizaci\u00f3n: un atacante probaba diferentes valores de token y observaba peque\u00f1as diferencias en el tiempo de respuesta (los caracteres incorrectos fallan m\u00e1s r\u00e1pido) para adivinar el token completo, car\u00e1cter por car\u00e1cter. Esto se solucion\u00f3 en la versi\u00f3n 6.0.1."}], "id": "CVE-2025-53940", "lastModified": "2026-06-17T09:39:09.883", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53940", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-25T13:30:29.993474Z", "version": "2.0.3"}}]}, "published": "2025-07-24T23:15:26.620", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269"}, {"source": "security-advisories@github.com", "url": "https://github.com/TryQuiet/quiet/pull/2928"}, {"source": "security-advisories@github.com", "url": "https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}