CVE-2025-64766

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.

• CWE-798

• https://github.com/NixOS/nixpkgs/commit/8e74d05e3de4ee5ad320cd585a7e0f12a4730869
• https://github.com/NixOS/nixpkgs/commit/cec38dec00df26a901eb8b424d53bbb3bcc72eec
• https://github.com/NixOS/nixpkgs/pull/462100
• https://github.com/NixOS/nixpkgs/pull/462204
• https://github.com/NixOS/nixpkgs/security/advisories/GHSA-58m4-5wg3-5g5v

Published

Nov 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64760Tuleap is a free and open source suite for management of sof…4.3
• CVE-2025-64761OpenBao is an open source identity-based secrets management …7.2
• CVE-2025-64762The AuthKit library for Next.js provides convenient helpers …9.1
• CVE-2025-64763Envoy is a high-performance edge/middle/service proxy. In 1.…5.3
• CVE-2025-64764Astro is a web framework. Prior to version 5.15.8, a reflect…5.4
• CVE-2025-64765Astro is a web framework. Prior to version 5.15.8, a mismatc…5.3
• CVE-2025-64767hpke-js is a Hybrid Public Key Encryption (HPKE) module buil…9.1
• CVE-2025-64769The Process Optimization application suite leverages connect…7.6
• CVE-2025-6477A vulnerability was found in SourceCodester Student Result M…4.8
• CVE-2025-64770The affected products allow unauthenticated access to Open N…7
• CVE-2025-64772The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an…8.4
• CVE-2025-64773In JetBrains YouTrack before 2025.3.104432 a race condition …3.7