← Database

CVE-2025-71457

CRITICAL CVSS: 9.8 Published: 2026-11-04 Modified: 2026-11-04

Description

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

Affected Platforms

Unknown

Weakness Type

CWE-620

References