PT-2025-21263 · Unknown · Pgina.Fork

Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-48027

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: pGina.Fork versions 3.9.9.12 and earlier

Description: The issue allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. This occurs due to a flaw in the HttpAuth plugin.

Recommendations: For versions 3.9.9.12 and earlier, as a temporary workaround, consider restricting access to the HttpAuth plugin until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-48027

Affected Products

Pgina.Fork

References · 7

• 🔥 https://github.com/kwburns/CVE/blob/main/pGina.Fork/3.9.9.12/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48027 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48027 · Vendor Advisory
• https://github.com/MutonUfoAI/pgina/blob/1922de0fe27492c09d2f188c2c7e54a4b364bbad/Plugins/HttpAuth/HttpAuth/Settings.cs#L44 · Note
• https://t.me/cvetracker/23891 · Telegram Post
• https://twitter.com/CVEnew/status/1922883801773941231 · Twitter Post
• https://t.me/cvenotify/122272 · Telegram Post