CVE-2025-29996

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-299978.2This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated CVE-2025-299988.2This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticat CVE-2025-299996.7A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable CVE-2025-30005.3A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads t CVE-2025-300006.7A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restri CVE-2025-300017.3Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.CVE-2025-300028.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300038.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300048.8Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute a CVE-2025-300058.3Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and a CVE-2025-300066.1Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects Compl CVE-2025-300078.8HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute