CVE-2025-27580

Description

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

Reserved 2025-03-03 | Published 2025-04-23 | Updated 2025-04-24 | Assigner mitre

Problem types

CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Product status

Default status
unknown

Any version
affected

References

github.com/brics-dev/brics

brics.cit.nih.gov

github.com/...e/src/main/java/gov/nih/tbi/CoreConstants.java

github.com/...ccount/service/complex/AccountManagerImpl.java

github.com/...ty.Research/blob/main/CVE-2025-27580/README.md

bugculture.io/CVE-2025-27580/

cve.org (CVE-2025-27580)

nvd.nist.gov (CVE-2025-27580)

Download JSON