CVE-2025-6920
Last modified
CVE-2025-6920 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows unauthorized users to access the same inference features available on protected endpoints, potentially exposing sensitive functionality or allowing unintended access to backend resources.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ai Inference Server | All versions |
References
- https://access.redhat.com/security/cve/CVE-2025-6920Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2375522Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6920?
How severe is CVE-2025-6920?
How do I fix CVE-2025-6920?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-69194A security issue was discovered in GNU Wget2 when handling M…9.8
- CVE-2025-69195A flaw was found in GNU Wget2. This vulnerability, a stack-b…8.8
- CVE-2025-69196FastMCP is the standard framework for building MCP applicati…6.5
- CVE-2025-69197Pterodactyl is a free, open-source game server management pa…6.5
- CVE-2025-69198Pterodactyl is a free, open-source game server management pa…6.5
- CVE-2025-69199Wings is the server control plane for Pterodactyl, a free, o…6.5
- CVE-2025-69200phpMyFAQ is an open source FAQ web application. In versions …7.5
- CVE-2025-69201Tugtainer is a self-hosted app for automating updates of doc…9.8
- CVE-2025-69202Axios Cache Interceptor is a cache interceptor for axios. Pr…6.5
- CVE-2025-69203Signal K Server is a server application that runs on a centr…8.8
- CVE-2025-69204ImageMagick is free and open-source software used for editin…7.5
- CVE-2025-69205Micro Registration Utility (µURU) is a telephone self regist…6.3
Are you affected by CVE-2025-6920?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST