CVE-2025-15105

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-15105

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15105.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-15105

Published

2025-12-27T09:02:06.124Z

Modified

2026-07-08T06:35:37.125120199Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

getmaxun auth.ts hard-coded key

Details

A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15105.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-320",
        "CWE-321"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.0.1"
                },
                {
                    "last_affected": "0.0.1"
                },
                {
                    "introduced": "0.0.2"
                },
                {
                    "last_affected": "0.0.2"
                },
                {
                    "introduced": "0.0.3"
                },
                {
                    "last_affected": "0.0.3"
                },
                {
                    "introduced": "0.0.4"
                },
                {
                    "last_affected": "0.0.4"
                },
                {
                    "introduced": "0.0.5"
                },
                {
                    "last_affected": "0.0.5"
                },
                {
                    "introduced": "0.0.6"
                },
                {
                    "last_affected": "0.0.6"
                },
                {
                    "introduced": "0.0.7"
                },
                {
                    "last_affected": "0.0.7"
                },
                {
                    "introduced": "0.0.8"
                },
                {
                    "last_affected": "0.0.8"
                },
                {
                    "introduced": "0.0.9"
                },
                {
                    "last_affected": "0.0.9"
                },
                {
                    "introduced": "0.0.10"
                },
                {
                    "last_affected": "0.0.10"
                },
                {
                    "introduced": "0.0.11"
                },
                {
                    "last_affected": "0.0.11"
                },
                {
                    "introduced": "0.0.12"
                },
                {
                    "last_affected": "0.0.12"
                },
                {
                    "introduced": "0.0.13"
                },
                {
                    "last_affected": "0.0.13"
                },
                {
                    "introduced": "0.0.14"
                },
                {
                    "last_affected": "0.0.14"
                },
                {
                    "introduced": "0.0.15"
                },
                {
                    "last_affected": "0.0.15"
                },
                {
                    "introduced": "0.0.16"
                },
                {
                    "last_affected": "0.0.16"
                },
                {
                    "introduced": "0.0.17"
                },
                {
                    "last_affected": "0.0.17"
                },
                {
                    "introduced": "0.0.18"
                },
                {
                    "last_affected": "0.0.18"
                },
                {
                    "introduced": "0.0.19"
                },
                {
                    "last_affected": "0.0.19"
                },
                {
                    "introduced": "0.0.20"
                },
                {
                    "last_affected": "0.0.20"
                },
                {
                    "introduced": "0.0.21"
                },
                {
                    "last_affected": "0.0.21"
                },
                {
                    "introduced": "0.0.22"
                },
                {
                    "last_affected": "0.0.22"
                },
                {
                    "introduced": "0.0.23"
                },
                {
                    "last_affected": "0.0.23"
                },
                {
                    "introduced": "0.0.24"
                },
                {
                    "last_affected": "0.0.24"
                },
                {
                    "introduced": "0.0.25"
                },
                {
                    "last_affected": "0.0.25"
                },
                {
                    "introduced": "0.0.26"
                },
                {
                    "last_affected": "0.0.26"
                },
                {
                    "introduced": "0.0.27"
                },
                {
                    "last_affected": "0.0.27"
                },
                {
                    "introduced": "0.0.28"
                },
                {
                    "last_affected": "0.0.28"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/getmaxun/maxun

Affected ranges

Type

GIT

Repo

https://github.com/getmaxun/maxun

Events

Introduced

Last affected

7d0ab5f32d777a0f62f83dce4e7cf1ed961ab527

Database specific

{
    "cpe": "cpe:2.3:a:maxun:maxun:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.0.28"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*

v0.0.01

v0.0.10

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.6

v0.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15105.json"