PT-2025-34076 · Unknown · Onboardlite

Bestdevofc · Published 2025-08-20 · Updated 2025-08-21 · CVE-2025-55751

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: OnboardLite versions with commit hash 6cca19e or later

Description: An attacker can manipulate a link to the trusted application, redirecting users to a malicious external site upon access. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements JWT signing for the redirect URL parameter.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-55751

GHSA-P8C5-QP4C-QR2M

Affected Products

Onboardlite

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55751.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55751 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55751 · Vendor Advisory
• https://github.com/HackUCF/OnboardLite/commit/6cca19ea4f47af125caa08ef82594844f039e07e · Note
• https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-p8c5-qp4c-qr2m · Note
• https://twitter.com/CVEnew/status/1958397824652939462 · Twitter Post