CVE-2025-66270: Medium severity KDE KDE Connect vulnerability
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66270?
CVE-2025-66270 is classified as a medium severity vulnerability.
How does CVE-2025-66270 affect KDE Connect?
CVE-2025-66270 affects KDE Connect by failing to properly correlate device IDs across packets, which can lead to potential security risks.
How do I fix CVE-2025-66270?
To fix CVE-2025-66270, update KDE Connect to version 25.12 or later, or the respective versions for iOS, Android, GSConnect, and Valent.
Which versions of KDE Connect are vulnerable to CVE-2025-66270?
KDE Connect versions below 25.12 on desktop, 0.5.4 on iOS, 1.34.4 on Android, GSConnect below 68, and Valent below 1.0.0.alpha.49 are vulnerable.
Is there any workaround for CVE-2025-66270?
There are no specific workarounds for CVE-2025-66270; updating to the secure version is the recommended course of action.