CVE-2025-55299

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-55299", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-12T16:15:30.238Z", "datePublished": "2025-08-18T17:36:28.462Z", "dateUpdated": "2025-08-18T17:54:17.654Z"}, "containers": {"cna": {"title": "VaulTLS has a password-based login exploit in additional user accounts", "problemTypes": [{"descriptions": [{"cweId": "CWE-521", "lang": "en", "description": "CWE-521: Weak Password Requirements", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m"}, {"name": "https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0", "tags": ["x_refsource_MISC"], "url": "https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0"}], "affected": [{"vendor": "7ritn", "product": "VaulTLS", "versions": [{"version": "< 0.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-18T17:36:28.462Z"}, "descriptions": [{"lang": "en", "value": "VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1."}], "source": {"advisory": "GHSA-pjfr-pj3h-cw8m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-18T17:54:05.323076Z", "id": "CVE-2025-55299", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T17:54:17.654Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55299", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-18T17:54:05.323076Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T17:54:09.049Z"}}], "cna": {"title": "VaulTLS has a password-based login exploit in additional user accounts", "source": {"advisory": "GHSA-pjfr-pj3h-cw8m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "7ritn", "product": "VaulTLS", "versions": [{"status": "affected", "version": "< 0.9.1"}]}], "references": [{"url": "https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m", "name": "https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0", "name": "https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "CWE-521: Weak Password Requirements"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-18T17:36:28.462Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55299", "state": "PUBLISHED", "dateUpdated": "2025-08-18T17:54:17.654Z", "dateReserved": "2025-08-12T16:15:30.238Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-18T17:36:28.462Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "VaulTLS", "vendor": "7ritn", "versions": [{"status": "affected", "version": "< 0.9.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1."}, {"lang": "es", "value": "VaulTLS es una soluci\u00f3n moderna para la gesti\u00f3n de certificados mTLS (TLS mutuo). Antes de la versi\u00f3n 0.9.1, las cuentas de usuario creadas a trav\u00e9s de la interfaz web de usuario ten\u00edan una contrase\u00f1a vac\u00eda, pero no nula. Los atacantes pod\u00edan usarla para iniciar sesi\u00f3n con una contrase\u00f1a vac\u00eda. Esto se suma a que, anteriormente, deshabilitar el inicio de sesi\u00f3n con contrase\u00f1a solo afectaba al frontend, pero permit\u00eda el inicio de sesi\u00f3n mediante la API. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.9.1."}], "id": "CVE-2025-55299", "lastModified": "2026-06-17T09:41:36.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55299", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-18T17:54:05.323076Z", "version": "2.0.3"}}]}, "published": "2025-08-18T18:15:40.023", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0"}, {"source": "security-advisories@github.com", "url": "https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-521"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}