PT-2026-4739 · Unknown · Altitude Authentication Service+1

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-41083

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Altitude Authentication Service and Altitude Communication Server version 8.5.3290.0

Description A flaw exists in Altitude Authentication Service and Altitude Communication Server version 8.5.3290.0 that allows manipulation of the Host header in HTTP requests. This manipulation can lead to redirection to an arbitrary URL or modification of the base URL, potentially tricking users into submitting login credentials to a malicious website controlled by an attacker. The issue involves redirecting clients to attacker-controlled endpoints. The Host header is the vulnerable parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2025-41083

Affected Products

Altitude Authentication Service

Altitude Communication Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-41083 · Security Note
• https://twitter.com/VulmonFeeds/status/2015785169785921980 · Twitter Post
• https://t.me/cveNotify/149842 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-altitude-communication-server · Note
• https://t.me/CVEtracker/42991 · Telegram Post
• https://twitter.com/CVEnew/status/2015733315492540612 · Twitter Post