CVE-2025-49591

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-49591

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49591.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-49591

Aliases

GHSA-xq5x-wgcm-3p33

Published

2025-06-18T22:15:16.890Z

Modified

2026-04-10T05:30:37.409775Z

Severity

7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

CryptPad 2FA Bypass Vulnerability

Details

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49591.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-287"
    ]
}

References

Affected packages

Git / github.com/cryptpad/cryptpad

Affected ranges

Type: GIT
Repo: https://github.com/cryptpad/cryptpad
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

52a4d926d902eb4f667cab49b14875174373ef80

Affected versions

0.*

0.2.0

0.3.0

1.*

1.1.0

1.1.1

1.11.0

1.12.0

1.18.0

1.2.0

1.20.0

1.21.0

1.22.0

1.23.0

1.24.0

1.3.0

1.4.0

1.8.0

1.9.0

2.*

2.17.0

2.17.05

2.17.06

2.19.0

2.21.0

2.22.0

2024.*

2024.3.0

2024.3.1

2024.6.0

3.*

3.10.0

3.14.0

3.15.0

3.18.0

3.18.1

3.20.1

3.23.0

3.23.1

3.23.2

3.3.0

3.7.0

3.8.0

3.9.0

4.*

4.4.0

4.5.0

4.6.0

4.7.0

4.8.0

5.*

5.2.0

5.2.1

5.3.0

5.4.0

5.5.0

5.6.0

5.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49591.json"

Git / github.com/xwiki-labs/cryptpad