PT-2025-47979 · Lunary Ai · Lunary

Published 2025-11-25 · Updated 2025-12-30 · CVE-2025-9803

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions prior to 1.9.35

Description The application is susceptible to account takeover due to flawed authentication within the Google OAuth integration. Specifically, the application does not validate the aud (audience) field present in the access token provided by Google. The aud field confirms the intended recipient of the token, and its absence of verification allows attackers to leverage tokens issued to malicious applications to gain unauthorized access to user accounts. The vulnerable component is the Google OAuth integration process.

Recommendations lunary-ai/lunary versions prior to 1.9.35 should be updated to version 1.9.35 or later.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2025-9803

Affected Products

Lunary

References · 12

• 🔥 https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9803 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9803 · Vendor Advisory
• https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91 · Note
• https://t.me/cveNotify/147178 · Telegram Post
• https://t.me/poxek/5728 · Telegram Post
• https://twitter.com/CVEnew/status/1993125716024754474 · Twitter Post
• https://t.me/CVEtracker/38141 · Telegram Post
• https://twitter.com/CveFindCom/status/1993132601486258659 · Twitter Post
• https://twitter.com/0dayPublishing/status/1993117436082634851 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993166356892500426 · Twitter Post
• https://t.me/cveNotify/143895 · Telegram Post