CVE-2025-61928

描述

### **Summary** A critical authentication bypass was identified in the API key creation and update endpoints. An attacker could create or modify API keys for arbitrary users by supplying a victim’s user ID in the request body. Due to a flaw in how the authenticated user was derived, the endpoints could treat attacker-controlled input as an authenticated user object under certain conditions. ### **Details** The vulnerability originated from fallback logic used when determining the current user. When no session was present, the handler incorrectly allowed request-body data to populate the user context used for authorization decisions. Because server-side validation only executed when authentication was required, privileged fields were not properly protected. As a result, the API accepted unauthenticated requests that targeted other users. This same pattern affected both the API key creation and update routes. ### **Impact** Unauthenticated attackers could generate or modify API keys belonging to any user. This granted full authenticated access as the targeted user and, depending on the user’s privileges, could lead to account compromise, access to sensitive data, or broader application takeover.

如何修補 CVE-2025-61928

要修補 CVE-2025-61928,請將受影響套件升級到下列已修補版本。

• —升級至 1.3.26 或更新版本

CVE-2025-61928 正在被利用嗎?

中等 — EPSS 為 18.0%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1.3.26

CVSS 分數