PT-2025-31394 · Cvat · Cvat

Nmanovic · Published 2025-07-30 · Updated 2025-07-30 · CVE-2025-54573

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CVAT versions 1.1.0 through 2.41.0

Description CVAT is an open source interactive video and image annotation tool for computer vision. Email verification was not enforced when using Basic HTTP Authentication in versions 1.1.0 through 2.41.0, allowing users to create accounts with fake email addresses and be treated as verified users. This also leaves the system open to bot signups and further usage.

Recommendations Update to version 2.42.0 or later. For CVAT Enterprise customers, disable registration to prevent this issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-54573

GHSA-FXGH-M76J-242Q

Affected Products

Cvat

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54573.json · Exploit
• https://github.com/cvat-ai/cvat/commit/bc20eff16b8406fbb755f6540e6f269da0c9c5b2 · Patch
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-fxgh-m76j-242q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54573 · Security Note
• https://t.me/CVEtracker/28754 · Telegram Post
• https://twitter.com/CVEnew/status/1950569218287534356 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950589563962847261 · Twitter Post