CVE-2025-65925

An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification controls and allowed unintended account creation. This could have enabled spam/fake account creation or resource usage impact. No data exposure or unauthorized access to existing accounts was reported.

• CWE-287

• https://github.com/Sneden/zeroheight-account-verification-bypass-CVE-2025-65925Third Party Advisory

Published

Dec 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65900Kalmia CMS version 0.2.0 contains an Incorrect Access Contro…6.5
• CVE-2025-6591Vulnerability in Wikimedia Foundation MediaWiki. This vulner…0
• CVE-2025-6592Vulnerability in Wikimedia Foundation AbuseFilter. This vuln…2.1
• CVE-2025-65922PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors h…4.3
• CVE-2025-65923A Stored Cross-Site Scripting (XSS) vulnerability was discov…5.4
• CVE-2025-65924ERPNext thru 15.88.1 does not sanitize or remove certain HTM…4.1
• CVE-2025-6593Vulnerability in Wikimedia Foundation MediaWiki. This vulner…2.1
• CVE-2025-65933Rejected reason: Not used
• CVE-2025-65934Rejected reason: Not used
• CVE-2025-65935Rejected reason: Not used
• CVE-2025-65936Rejected reason: Not used
• CVE-2025-65937Rejected reason: Not used