CVE-2025-54573
Last modified
CVE-2025-54573 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the missing email verification check leaves the system open to bot signups and further usage. CVAT 2.42.0 and later versions contain a fix for the issue. CVAT Enterprise customers have a workaround available; those customers may disable registration to prevent this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cvat | Computer Vision Annotation Tool | >= 1.1.0, < 2.42.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54573?
How severe is CVE-2025-54573?
How do I fix CVE-2025-54573?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54566hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration s…5.4
- CVE-2025-54567hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF…5.4
- CVE-2025-54568Akamai Rate Control alpha before 2025 allows attackers to se…3.7
- CVE-2025-54569In Malwarebytes Binisoft Windows Firewall Control before 6.1…4.5
- CVE-2025-54571ModSecurity is an open source, cross platform web applicatio…6.1
- CVE-2025-54572The Ruby SAML library is for implementing the client side of…6.9
- CVE-2025-54574Squid is a caching proxy for the Web. In versions 6.3 and be…9.8
- CVE-2025-54575ImageSharp is a 2D graphics library. In versions below 2.1.1…5.3
- CVE-2025-54576OAuth2-Proxy is an open-source tool that can act as either a…9.1
- CVE-2025-54581vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3…7.5
- CVE-2025-54582Rejected reason: Reason: This candidate was issued in error.…
- CVE-2025-54583GitProxy is an application that stands between developers an…6.5
Are you affected by CVE-2025-54573?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST