CVE-2025-62168

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.

• CWE-209
• CWE-550

• https://github.com/squid-cache/squid/commit/0951a0681011dfca3d78c84fd7f1e19c78a4443fPatch
• https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxrMitigation, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2025/11/05/6

Published

Oct 17, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62159External Secrets Operator reads information from a third-par…8.7
• CVE-2025-6216Allegra calculateTokenExpDate Password Recovery Authenticati…9.8
• CVE-2025-62161Youki is a container runtime written in Rust. In versions 0.…10
• CVE-2025-62162cel-rust is a Common Expression Language interpreter written…7.5
• CVE-2025-62164vLLM is an inference and serving engine for large language m…8.8
• CVE-2025-62166FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28…7.5
• CVE-2025-62169OctoPrint-SpoolManager is a plugin for managing spools and a…8.1
• CVE-2025-6217PEAK-System Driver PCANFD_ADD_FILTERS Time-Of-Check Time-Of-…2.5
• CVE-2025-62170rAthena is an open-source cross-platform MMORPG server. A us…7.5
• CVE-2025-62171ImageMagick is an open source software suite for displaying,…7.5
• CVE-2025-62172Home Assistant is open source home automation software that …8.5
• CVE-2025-62173## Summary Authenticated SQL Injection Vulnerability in End…8.6