PT-2025-37193 · Wind River Studio Developer · Wind River Studio Developer

CVE-2025-26499 · Published 2025-09-11 · Updated 2025-09-11

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: (affected versions not specified)

Description: A race condition can occur during authentication or token refresh operations under heavy system utilization. This allows a user to be granted a token intended for another user, potentially leading to impersonation until the session ends. The flaw cannot be intentionally exploited due to the need for concurrent action by two users, but if it occurs, a user could be inadvertently exposed to another user’s system rights and data access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-270

Related Identifiers

CVE-2025-26499

Affected Products

Wind River Studio Developer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-26499 · Security Note
• https://twitter.com/CVEnew/status/1966191602856243346 · Twitter Post
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26499 · Note
• https://windriver.com/security/vulnerability-responses/CVE-2025-26499 · Note