PT-2025-13811 · Unknown · Coding Hut

Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-31122

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Coding Hut versions 1.0-beta3 and earlier

Description The issue allows an attacker to log in to any account by modifying the username field in the login link. This affects the login functionality of the website.

Recommendations For versions 1.0-beta3 and earlier, as a temporary workaround, consider restricting access to the login functionality until a patch is available. Avoid using the username field in the affected login link until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-287

CWE-290

Related Identifiers

CVE-2025-31122

GHSA-MMG3-567W-V9J2

Affected Products

Coding Hut

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31122.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-31122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31122 · Security Note
• https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/56 · Note
• https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut/security/advisories/GHSA-mmg3-567w-v9j2 · Note
• https://twitter.com/CVEnew/status/1906757209003856322 · Twitter Post
• https://twitter.com/threatsbank/status/1906965832661373406 · Twitter Post
• https://t.me/cvetracker/20378 · Telegram Post
• https://t.me/cvedetector/21642 · Telegram Post