CVE-2025-71457
vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
| CWE | CWE-620 |
| Vendor | vtenext |
| Product | vtenext |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for vtenext vtenext
Be the first to know when new critical vulnerabilities affecting vtenext vtenext are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
vtenext / vtenext
25.02 < 25.02.1
References
blog.sicuranext.com: https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/ 0xbro.red: https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/ usermanual.vtenext.com: https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note vulncheck.com: https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php
Credits
Mattia "0xbro" Brollo