CVE-2025-13948
Last modified
CVE-2025-13948 is a medium-severity vulnerability rated 5.6/10 on the CVSS scale. A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. Executing manipulation of the argument secret key can lead to use of hard-coded cryptographic key . The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-13948?
How severe is CVE-2025-13948?
How do I fix CVE-2025-13948?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-13941A local privilege escalation vulnerability exists in the Fox…8.8
- CVE-2025-13942A command injection vulnerability in the UPnP function of th…9.8
- CVE-2025-13943A post-authentication command injection vulnerability in the…8.8
- CVE-2025-13945HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows de…5.5
- CVE-2025-13946MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 a…5.5
- CVE-2025-13947A flaw was found in WebKitGTK. This vulnerability allows rem…7.4
- CVE-2025-13949A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.…6.3
- CVE-2025-1395Generation of Error Message Containing Sensitive Information…8.2
- CVE-2025-13950The OneSignal – Web Push Notifications plugin for WordPress …5.3
- CVE-2025-13952A web page that contains unusual GPU shader code is loaded f…9.8
- CVE-2025-13953Bypass vulnerability in the authentication method in the GTT…9.3
- CVE-2025-13954Hard-coded cryptographic keys in Admin UI of EZCast Pro II b…9.3
Are you affected by CVE-2025-13948?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST