CVE-2025-4894

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects the function gen_rsa_keys of the file common/crypto.py. The manipulation leads to inadequate encryption strength. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-310CWE-326

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-489407.2MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allCVE-2025-489415.3MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which alCVE-2025-489426.5vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/compCVE-2025-489436.5vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (CVE-2025-489446.5vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used CVE-2025-489458.2pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynCVE-2025-489463.7liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version CVE-2025-489477.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 throughCVE-2025-489486.5Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allowCVE-2025-489499.8Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improCVE-2025-48959.8A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some CVE-2025-489508.8MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary