CVE-2025-71457: vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid username can send action=changepassword to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who knows a valid vtenext user_name can attempt to change that account's password. Accounts without two-factor authentication are specifically described as allowing the attacker to log in after the password change.
Which deployments are affected?
The affected version range is vtenext 25.02 before 25.02.1. The vulnerable password-change path is hub/rpwd.php.
What does an attacker need to send?
The attacker needs a valid user_name and can invoke RecoverPwd::displayChangePwd() with action=change_password. The password-change request is not protected by token verification.
How can defenders determine whether they may have been compromised?
Review password-change activity and authentication logs for unexpected password resets or logins, particularly involving administrator accounts without two-factor authentication. Investigate requests to hub/rpwd.php using action=change_password for user accounts whose owners did not initiate a password change.