CVE-2025-56748: Medium severity Creativeitem Academy LMS vulnerability
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56748?
CVE-2025-56748 is considered a high-severity vulnerability due to its potential to allow attackers to compromise user accounts through brute force attacks on password reset tokens.
How do I fix CVE-2025-56748?
To fix CVE-2025-56748, implement additional security measures such as rate limiting for password reset requests and use secure, unpredictable tokens.
What systems are affected by CVE-2025-56748?
CVE-2025-56748 affects Creativeitem Academy LMS versions up to and including 5.13.
Can CVE-2025-56748 lead to account takeover?
Yes, CVE-2025-56748 can lead to account takeover as attackers can exploit the predictable password reset tokens.
Is there a workaround for CVE-2025-56748?
While the best solution is to update to a fixed version, temporarily, you can mitigate CVE-2025-56748 by disabling password reset functionality.