PT-2026-4751 · Unknown · Access Manager

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59101

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Access Manager (affected versions not specified)

Description The system authenticates users based on their IP address rather than using standard session tokens or cookies. Once an IP address successfully logs in, it is considered authenticated for subsequent requests. This design allows for potential unauthorized access by spoofing the IP address of a logged-in user to the Access Manager web interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-291

Related Identifiers

CVE-2025-59101

Affected Products

Access Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59101 · Security Note
• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://r.sec-consult.com/dkaccess · Note
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/CVEnew/status/2015733302993518983 · Twitter Post
• https://t.me/CVEtracker/43003 · Telegram Post
• https://t.me/CVEtracker/43004 · Telegram Post