PT-2025-4304 · Nicegui · Nicegui

Streamcfd · CVE-2025-21618 · Published 2025-01-06 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 2.9.1

Description The issue concerns a session management problem in NiceGUI, a Python-based UI framework. Before version 2.9.1, authenticating with NiceGUI would log the user into all browsers, including those in incognito mode. This means that once a user logged in to one browser, all other browsers would also be logged in without requiring a password, even in incognito mode. The impact of this issue is considered high.

Recommendations For versions prior to 2.9.1, update to version 2.9.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information or using an alternative authentication method until the update can be applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-21618

GHSA-V6JV-P6R8-J78W

PYSEC-2026-1705

Affected Products

Nicegui

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21618.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-21618 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21618 · Security Note
• https://osv.dev/vulnerability/GHSA-v6jv-p6r8-j78w · Vendor Advisory
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/commit/1621a4ba6a06676b8094362d36623551e651adc1 · Note
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w · Note
• https://twitter.com/VulmonFeeds/status/1876329480819458518 · Twitter Post
• https://github.com/advisories/GHSA-v6jv-p6r8-j78w · Note
• https://twitter.com/CVEnew/status/1876310991123906882 · Twitter Post
• https://t.me/cvedetector/14373 · Telegram Post
• https://pypi.org/project/nicegui · Note
• https://t.me/latest_high_impact_cve/1747 · Telegram Post