CVE-2025-23164

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-231653.7In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated CVE-2025-231667.5The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background t CVE-2025-231676.5A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This in CVE-2025-231688.8The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via ema CVE-2025-231696.1The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However CVE-2025-23177.5The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all version CVE-2025-231706.7The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via S CVE-2025-231717.2The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly CVE-2025-231727.2The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, t CVE-2025-231737.5The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By defa CVE-2025-231747.5CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-231756.1Multiple XSS (CWE-79)