PT-2025-30706 · Quiet · Quiet

Published 2025-07-24 · Updated 2025-07-25 · CVE-2025-53940

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Quiet versions 6.1.0-alpha.4 and below

Description Quiet’s API for backend/frontend communication used an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker could attempt to guess the entire token one character at a time by observing slight differences in response times.

Recommendations Upgrade to version 6.0.1.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2025-53940

GHSA-GPW8-W78H-XJ67

Affected Products

Quiet

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53940.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53940 · Security Note
• https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67 · Note
• https://github.com/TryQuiet/quiet/pull/2928 · Note
• https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269 · Note
• https://twitter.com/CVEnew/status/1948513845640573083 · Twitter Post
• https://twitter.com/CveFindCom/status/1948513719761137945 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948539254985891917 · Twitter Post