CVE-2025-43863: vantage6 lacks brute-force protection on change password functionality
Impact If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct
Patches This issue has been patched in version 4.11.0
Workarounds None
Other sources
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43863?
CVE-2025-43863 is rated as a high severity vulnerability due to its potential to allow unauthorized password brute-force attempts.
How do I fix CVE-2025-43863?
To fix CVE-2025-43863, upgrade the 'vantage6' package to version 4.11.0 or later.
What is the impact of CVE-2025-43863?
The impact of CVE-2025-43863 includes the possibility for attackers to exploit an authenticated session to perform multiple password brute-force attempts.
Is my software affected by CVE-2025-43863?
If you are using 'vantage6' version prior to 4.11.0, your software is affected by CVE-2025-43863.
Who discovered CVE-2025-43863?
CVE-2025-43863 was discovered by the security team associated with the 'vantage6' software project.