CVE-2025-29996

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

• CWE-288

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048

Published

Mar 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2999A vulnerability was found in PyTorch 2.6.0. It has been rate…5.3
• CVE-2025-29991Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incor…2.2
• CVE-2025-29992Mahara before 24.04.9 exposes database connection informatio…7.5
• CVE-2025-29993The affected versions of PowerCMS allow HTTP header injectio…5.3
• CVE-2025-29994This vulnerability exists in the CAP back office application…8.2
• CVE-2025-29995This vulnerability exists in the CAP back office application…8.3
• CVE-2025-29997This vulnerability exists in the CAP back office application…8.2
• CVE-2025-29998This vulnerability exists in the CAP back office application…8.2
• CVE-2025-29999A vulnerability has been identified in Siemens License Serve…6.7
• CVE-2025-3000A vulnerability classified as critical has been found in PyT…5.3
• CVE-2025-30000A vulnerability has been identified in Siemens License Serve…6.7
• CVE-2025-30001Incorrect Execution-Assigned Permissions vulnerability in Ap…7.3