Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2025-71457: vtenext allows password change without verification
CVE-2025-71457 · published 4 days ago
Summary
Versions of vtenext up to 25.02 let anyone who knows a user name reset that user's password through a specific web page, bypassing normal login checks. This can let an attacker take over accounts, including admin accounts that do not use extra login steps. Update to the latest version or apply the vendor's patch to require proper authentication before password changes.
What to do
- Update vtenext vtenext to version 25.02.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vtenext | vtenext | < 25.02.1 |
Original advisory text
vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-620Unverified Password Change
Timeline
Published4 Nov 2026
Updated6 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta