CVE-2025-43863

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
vantage6	vantage6	< 4.11.0

References

https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hwVendor Advisory

Timeline

Published: Jun 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-438647.5React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch t CVE-2025-438658.2React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by addin CVE-2025-438667.5vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unles CVE-2025-438678.5- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX CVE-2025-43878.8The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validat CVE-2025-438738.7Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.CVE-2025-438748.7: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ul CVE-2025-438758.7Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-438768.7Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-438774.8WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the web CVE-2025-438786.0When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Ap CVE-2025-438799.3WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilit