Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-27422: FACTION lets attackers create admin accounts to bypass login
CVE-2025-27422 · published 1 year ago
Summary
FACTION’s user‑registration process does not stop a person from signing up as an administrator, allowing them to get past the login step. This can be done at any time as long as the registration form is filled out correctly. Apply the update that includes version 1.4.3 or later to close the gap.
Original advisory text
FACTION Allows Authentication Bypass via User Creation
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
References
- https://github.com/factionsecurity/faction/security/advisories/GHSA-97cv-f342-v2... Vendor Advisory
- https://github.com/factionsecurity/faction/commit/0a6848d388d6dba1c81918cce2772b... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27422... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27422 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published3 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta