CVE-2025-3895 | THREATINT

Description

Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators). Version 5.20 of MegaBIP fixes this issue.

Reserved 2025-04-23 | Published 2025-05-23 | Updated 2025-05-23 | Assigner CERT-PL

CRITICAL: 9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-334 Small Space of Random Values

Product status

Default status

unaffected

Any version

affected

Credits

Kamil Szczurowski finder

Robert Kruczek finder

References

cert.pl/en/posts/2025/05/CVE-2025-3893 third-party-advisory

megabip.pl/index.php?id=24,145 vendor-advisory

www.gov.pl/...twa-dotyczaca-biuletynow-informacji-publicznej government-resource

cve.org (CVE-2025-3895)

nvd.nist.gov (CVE-2025-3895)

Download JSON