CVE-2025-5409

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-5409

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5409.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-5409

Published

2025-06-01T22:00:16.052Z

Modified

2026-07-15T01:49:08.468349554Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Mist Community Edition API Token views.py create_token access control

Details

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The identifier of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.

Database specific

{
    "cwe_ids": [
        "CWE-266",
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5409.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/mistio/mist-ce

Affected ranges

Type

GIT

Repo

https://github.com/mistio/mist-ce

Events

Introduced

e7a565f818a7217b0c8dba533078abe8c81e9f1f

Fixed

c655e86ac67147a10d0911ea027e3789c4451bf6

Database specific

{
    "cpe": "cpe:2.3:a:mist:mist:*:*:*:*:community:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.7.0"
        },
        {
            "last_affected": "4.7.0"
        },
        {
            "introduced": "4.7.1"
        },
        {
            "last_affected": "4.7.1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Type

GIT

Repo

https://github.com/mistio/mist.api

Events

Introduced

Fixed

db10ecb62ac832c1ed4924556d167efb9bc07fad

Database specific

{
    "source": "REFERENCES"
}

Affected versions

4.*

4.7.0

4.7.1

v4.*

v4.7.0

v4.7.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5409.json"