PT-2025-51155 · Unknown · Martialbe One-Hub

28Hus · Published 2025-12-14 · Updated 2025-12-14 · CVE-2025-14651

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MartialBE one-hub versions up to 0.14.27

Description A security issue exists in MartialBE one-hub related to the use of a hard-coded cryptographic key. The issue stems from the manipulation of the SESSION SECRET argument within the docker-compose.yml file. This allows for potential remote exploitation, though the complexity is considered high and exploitability is difficult. The exploit has been publicly disclosed.

Recommendations Change the configuration settings. Carefully check and modify every configuration and environment variable if using the default docker-compose example file in a production environment.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-14651

Affected Products

Martialbe One-Hub

References · 12

• 🔥 https://github.com/MartialBE/one-hub/blob/main/docker-compose.yml#L15C24-L15C38 · Exploit
• https://osv.dev/vulnerability/CVE-2025-14651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14651 · Security Note
• https://github.com/MartialBE/one-hub/issues/872#issuecomment-3616033169 · Note
• https://github.com/MartialBE/one-hub/issues/872 · Note
• https://t.me/CVEtracker/39763 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000141389858845019 · Twitter Post
• https://twitter.com/CVEnew/status/2000246112670581013 · Twitter Post
• https://t.me/cveNotify/145700 · Telegram Post
• https://vuldb.com/?id.336384 · Note
• https://vuldb.com/?ctiid.336384 · Note
• https://vuldb.com/?submit.710249 · Note