by Kastro
Paper/Archive/CVE-2025-55299

CVE-2025-55299

7ritn VaulTLS — VaulTLS has a password-based login exploit in additional user accounts

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
31
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 14.1.141 × 202.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1.

Affected

ProductAffectedFixed inSource
VaulTLS< 0.9.1–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8mrefgithub.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0