CVE-2025-27422: FACTION Allows Authentication Bypass via User Creation
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27422?
CVE-2025-27422 is a critical vulnerability that allows attackers to gain admin privileges without authentication.
How do I fix CVE-2025-27422?
To fix CVE-2025-27422, update FACTION to version 1.4.4 or later, which addresses this security issue.
What are the potential impacts of CVE-2025-27422?
The potential impacts of CVE-2025-27422 include unauthorized access to administrative functions and the ability to compromise sensitive data.
Who is affected by CVE-2025-27422?
Any users of FACTION version 1.4.3 or earlier are affected by CVE-2025-27422 due to the authentication bypass.
Is CVE-2025-27422 a user-specific or system-wide vulnerability?
CVE-2025-27422 is a system-wide vulnerability that affects the entire application and all users with the capability to register.