PT-2025-51155 · Unknown · Martialbe One-Hub

28Hus · Published 2025-12-14 · Updated 2025-12-14 · CVE-2025-14651

Positive Technologies · (AI Summary)

CVSS v3.1

3.7

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MartialBE one-hub versions up to 0.14.27

Description A security issue exists in MartialBE one-hub related to the use of a hard-coded cryptographic key. The issue stems from the manipulation of the

SESSION SECRET

argument within the

docker-compose.yml

file. This allows for potential remote exploitation, though the complexity is considered high and exploitability is difficult. The exploit has been publicly disclosed.

Recommendations Change the configuration settings. Carefully check and modify every configuration and environment variable if using the default docker-compose example file in a production environment.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-14651

Affected Products

Martialbe One-Hub

References · 11

• 🔥 https://github.com/MartialBE/one-hub/blob/main/docker-compose.yml#L15C24-L15C38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14651 · Security Note
• https://github.com/MartialBE/one-hub/issues/872 · Note
• https://github.com/MartialBE/one-hub/issues/872#issuecomment-3616033169 · Note
• https://vuldb.com/?submit.710249 · Note
• https://vuldb.com/?id.336384 · Note
• https://twitter.com/CVEnew/status/2000246112670581013 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000141389858845019 · Twitter Post
• https://t.me/CVEtracker/39763 · Telegram Post
• https://vuldb.com/?ctiid.336384 · Note
• https://t.me/cveNotify/145700 · Telegram Post