{"id":"CVE-2025-71457","published":"2026-11-04T21:17:40.340","lastModified":"2026-11-04T21:17:40.340","description":"vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-620"],"vendors":[],"products":[],"references":[{"url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/","tags":[]},{"url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/","tags":[]},{"url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note","tags":[]},{"url":"https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An authentication bypass in vtenext 25.02 before 25.02.1 allows unauthenticated attackers to change any user's password—including administrators—by sending a request to hub/rpwd.php without token verification, enabling full account takeover.","exploitability":"Exploitation is straightforward for an attacker who knows a valid username; no authentication or prior access is required.","blast_radius":"Successful exploitation grants full administrative access to accounts lacking two-factor authentication, risking complete system compromise and data breach.","remediation":"Upgrade to vtenext version 25.02.1 or later, which includes token verification for password change requests.","detection":"Defenders should monitor for repeated POST requests to /hub/rpwd.php with action=change_password from unauthenticated sessions, especially targeting known usernames; such requests lack valid session tokens and may appear in access logs with HTTP 200 responses despite missing authentication.","tags":["auth-bypass","password-reset","webapp","critical"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:46:13.763Z"}}