CVE-2025-30344

An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds).

• CWE-208
• CWE-203

• https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlidesExploit, Third Party Advisory

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3033After selecting a malicious Windows `.url` shortcut from the…7.7
• CVE-2025-30330Illustrator versions 29.3, 28.7.5 and earlier are affected b…7.8
• CVE-2025-30334In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before erra…7.1
• CVE-2025-3034Memory safety bugs present in Firefox 136 and Thunderbird 13…8.1
• CVE-2025-30342An XSS issue was discovered in OpenSlides before 4.2.5. When…6.1
• CVE-2025-30343A directory traversal issue was discovered in OpenSlides bef…6.5
• CVE-2025-30345An issue was discovered in OpenSlides before 4.2.5. When cre…4.1
• CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0…4.8
• CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers …7.5
• CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorith…5.3
• CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Fra…7.2
• CVE-2025-3035By first using the AI chatbot in one tab and later activatin…5.3