CVE-2025-49591
Last modified
CVE-2025-49591 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xwiki | Cryptpad | < 2025.3.0 |
References
- https://github.com/cryptpad/cryptpad/security/advisories/GHSA-xq5x-wgcm-3p33Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-49591?
How severe is CVE-2025-49591?
How do I fix CVE-2025-49591?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-49585XWiki is a generic wiki platform. In versions before 15.10.1…8
- CVE-2025-49586XWiki is an open-source wiki software platform. Any XWiki us…8.8
- CVE-2025-49587XWiki is an open-source wiki software platform. When a user …8
- CVE-2025-49588Linkwarden is a self-hosted, open-source collaborative bookm…8.7
- CVE-2025-49589PCSX2 is a free and open-source PlayStation 2 (PS2) emulator…6.1
- CVE-2025-49590CryptPad is a collaboration suite. Prior to version 2025.3.0…6.1
- CVE-2025-49592n8n is a workflow automation platform. Versions prior to 1.9…5.4
- CVE-2025-49593Portainer Community Edition is a lightweight service deliver…6.8
- CVE-2025-49594XWiki OIDC has various tools to manipulate OpenID Connect pr…9.2
- CVE-2025-49595n8n is a workflow automation platform. Prior to version 1.99…4.9
- CVE-2025-49596The MCP inspector is a developer tool for testing and debugg…9.4
- CVE-2025-49597handcraftedinthealps goodby-csv is a highly memory efficient…3.9
Are you affected by CVE-2025-49591?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST