CVE-2025-68435

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-68435

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68435.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-68435

Aliases

GHSA-x539-c98q-38gv

Published

2025-12-17T23:10:38.359Z

Modified

2026-01-29T02:52:10.737052Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Zerobyte has Authentication Bypass by Primary Weakness

Details

Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.

Database specific

{
    "cwe_ids": [
        "CWE-305"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68435.json"
}

References

Affected packages

Git / github.com/nicotsx/zerobyte

Affected ranges

Type: GIT
Repo: https://github.com/nicotsx/zerobyte
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

cae615868af1ec017aac834a5c9c6df4d1a597ea

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68435.json"