CVE-2025-9604

A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey leads to use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. To fix this issue, it is recommended to deploy a patch. The vendor replied to the GitHub issue (translated from simplified Chinese): "For scenarios requiring encryption, we will implement user-defined key management through configuration and optimize the use of encryption tools, such as random salt."

• CWE-320
• CWE-321

• https://github.com/coze-dev/coze-studio/issues/505
• https://github.com/coze-dev/coze-studio/issues/505#issuecomment-3148568862
• https://github.com/coze-dev/coze-studio/pull/533
• https://vuldb.com/?ctiid.321780
• https://vuldb.com/?id.321780
• https://vuldb.com/?submit.636417

Published

Aug 29, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9598A security flaw has been discovered in itsourcecode Apartmen…9.8
• CVE-2025-9599A weakness has been identified in itsourcecode Apartment Man…9.8
• CVE-2025-9600A security vulnerability has been detected in itsourcecode A…9.8
• CVE-2025-9601A vulnerability was detected in itsourcecode Apartment Manag…9.8
• CVE-2025-9602A vulnerability was found in Xinhu RockOA up to 2.6.9. Impac…6.5
• CVE-2025-9603A vulnerability was determined in Telesquare TLR-2005KSH 1.2…9.8
• CVE-2025-9605A security vulnerability has been detected in Tenda AC21 and…9.8
• CVE-2025-9606A vulnerability was detected in Portabilis i-Educar up to 2.…8.8
• CVE-2025-9607A flaw has been found in Portabilis i-Educar up to 2.10. Aff…8.8
• CVE-2025-9608A vulnerability has been found in Portabilis i-Educar up to …8.8
• CVE-2025-9609A vulnerability was found in Portabilis i-Educar up to 2.10.…8.8
• CVE-2025-9610A vulnerability was determined in code-projects Online Event…9.8