PT-2025-26224 · Allegra · Allegra

Swagat · Published 2025-06-19 · Updated 2025-07-14 · CVE-2025-6216

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Allegra (affected versions not specified)

Description: The issue concerns an authentication bypass vulnerability in the Allegra tool, allowing a remote attacker to bypass authentication on affected installations. This vulnerability is related to the password recovery feature and the calculateTokenExpDate function.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-6216

ZDI-25-410

Affected Products

Allegra

References · 10

• https://zerodayinitiative.com/advisories/ZDI-25-410 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6216 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6216 · Vendor Advisory
• https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/1944728602203058535 · Twitter Post
• https://t.me/latest_high_impact_cve/2746 · Telegram Post
• https://twitter.com/CVEnew/status/1936472515993305154 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1936162827112231247 · Twitter Post
• https://t.me/cvetracker/26721 · Telegram Post
• https://twitter.com/CCBalert/status/1936041683298263082 · Twitter Post