PT-2025-20601 · Unknown · Jadmin-Java

Bi8Bu · Published 2025-05-09 · Updated 2025-10-10 · CVE-2025-4494

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAdmin-JAVA JAdmin version 1.0

Description A critical vulnerability was found in the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations As a temporary workaround, consider disabling the toLogin function until a patch is available. Restrict access to the Admin Backend component to minimize the risk of exploitation. Avoid using the NoNeedLoginController.java file in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-4494

Affected Products

Jadmin-Java

References · 13

• 🔥 https://github.com/JAdmin-JAVA/JAdmin/issues/1 · Exploit
• 🔥 https://github.com/JAdmin-JAVA/JAdmin/issues/1#issue-3012501470 · Exploit
• https://osv.dev/vulnerability/CVE-2025-4494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4494 · Security Note
• https://vuldb.com/?ctiid.308208 · Note
• https://vuldb.com/?id.308208 · Note
• https://twitter.com/CVEnew/status/1920980718554861635 · Twitter Post
• https://t.me/latest_high_impact_cve/2318 · Telegram Post
• https://t.me/cvetracker/23521 · Telegram Post
• https://t.me/cvedetector/24988 · Telegram Post
• https://t.me/cvenotify/121617 · Telegram Post
• https://t.me/cveNotify/138208 · Telegram Post
• https://vuldb.com/?submit.566984 · Note