PT-2025-47340 · Unknown · Openml.Org Web Application

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-55796

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions openml/openml.org web application version v2.0.20241110

Description The web application generates predictable tokens based on MD5 hashing for critical user actions, including signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are created by hashing the current timestamp formatted as "%d %H:%M:%S" without user-specific data or cryptographic randomness. This predictability allows attackers to brute-force valid tokens within a short timeframe, potentially enabling unauthorized account confirmation, password resets, and email change approvals, which could lead to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-55796

GHSA-XFJH-GF9P-8QR6

Affected Products

Openml.Org Web Application

References · 8

• 🔥 https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-55796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55796 · Security Note
• https://github.com/openml/openml.org · Note
• https://t.me/CVEtracker/37640 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990882168654954920 · Twitter Post
• https://github.com/openml · Note
• https://twitter.com/CVEnew/status/1991042995928375680 · Twitter Post