CVE-2025-55127
Last modified
CVE-2025-55127 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Aquaplatform | Revive Adserver | >= 6.0.0, < 6.0.3 |
References
- https://hackerone.com/reports/3413764Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-55127?
How severe is CVE-2025-55127?
How do I fix CVE-2025-55127?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-55118Memory corruptions can be remotely triggered in the Control-…8.9
- CVE-2025-5512A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-55123Improper neutralization of input in Revive Adserver 5.5.2 an…5.4
- CVE-2025-55124Improper neutralisation of input in Revive Adserver 6.0.0+ c…6.1
- CVE-2025-55125This vulnerability allows a Backup or Tape Operator to perfo…9.8
- CVE-2025-55126HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
- CVE-2025-55128HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
- CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reporte…5.4
- CVE-2025-5513A vulnerability has been found in quequnlong shiyi-blog up t…5.4
- CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to by…9.1
- CVE-2025-55131A flaw in Node.js's buffer allocation logic can expose unini…7.1
- CVE-2025-55132A flaw in Node.js's permission model allows a file's access …5.3
Are you affected by CVE-2025-55127?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST