PT-2025-25341 · Vantage6 · Vantage6

Bartvanb · Published 2025-06-12 · Updated 2025-09-17 · CVE-2025-43863

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 4.11

Description The issue concerns an open-source framework designed for privacy-enhancing technologies such as Federated Learning and Multi-Party Computation. If an attacker gains access to an authenticated session, they can exploit the change password functionality to brute-force the user password. This is possible because the change password route can be called infinitely, providing feedback on incorrect passwords until the correct one is entered.

Recommendations For versions prior to 4.11, update to version 4.11 to resolve the issue.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-43863

GHSA-J6G5-P62X-58HW

PYSEC-2025-220

Affected Products

Vantage6

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43863.json · Exploit
• https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-220 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43863 · Security Note
• https://osv.dev/vulnerability/GHSA-j6g5-p62x-58hw · Vendor Advisory
• https://github.com/vantage6/vantage6 · Note
• https://github.com/vantage6/vantage6/commit/e0f1841b310f6f610e8137db2506cf683ce154d0 · Note
• https://twitter.com/CVEnew/status/1933216511008653604 · Twitter Post
• https://t.me/cvenotify/125533 · Telegram Post
• https://t.me/cveNotify/135696 · Telegram Post
• https://t.me/cvetracker/26113 · Telegram Post