PT-2025-41496 · Allstar+1 · Allstar+1

Adamkorcz · Published 2025-10-09 · Updated 2025-10-27 · CVE-2025-61926

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Allstar versions prior to 4.5

Description Allstar is a GitHub App used for setting and enforcing security policies. A flaw exists in the Reviewbot component where inbound webhook requests were validated against a hard-coded, shared secret. This secret token was compiled into the Allstar binary and could not be configured during runtime. Deployments using Reviewbot validated requests with the same secret unless the operator modified the source code and rebuilt the component. This expectation was not documented and easily overlooked. Deployments that have not enabled or exposed the Reviewbot endpoint are not affected.

Recommendations Update to version 4.5 or later. If the Reviewbot endpoint is not in use, no action is required.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-453

Related Identifiers

CVE-2025-61926

GHSA-33F4-MJCH-7FPR

GO-2025-4018

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Allstar

Reviewbot

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61926.json · Exploit
• 🔥 https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59 · Exploit
• 🔥 https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr · Exploit
• https://osv.dev/vulnerability/CVE-2025-61926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61926 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4018 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33f4-mjch-7fpr · Vendor Advisory
• https://github.com/ossf/allstar/pull/713 · Note
• https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73 · Note
• https://github.com/ossf/allstar · Note
• https://pkg.go.dev/vuln/GO-2025-4018 · Note
• https://twitter.com/VulmonFeeds/status/1976489514018173172 · Twitter Post
• https://suse.com/security/cve/CVE-2025-59347 · Note