CVE-2025-54866

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in version 4.13.0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
wazuh	wazuh	>= 4.3.0, < 4.13.0

References

https://github.com/wazuh/wazuh/commit/606f19e688944ebe5d28d72eb81ac36f8fffb143Patch
https://github.com/wazuh/wazuh/pull/31187Issue Tracking, Patch
https://github.com/wazuh/wazuh/releases/tag/v4.13.0Release Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-mvfx-ph7m-qm37Exploit, Vendor Advisory

Timeline

Published: Nov 21, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-548677.0Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potential CVE-2025-548687.5LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbit CVE-2025-548696.0FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versio CVE-2025-54877.2The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable t CVE-2025-548708.7VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversio CVE-2025-548717.8Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows loc CVE-2025-548728.7onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-i CVE-2025-548732.7RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0 CVE-2025-548749.8OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory CVE-2025-548759.8FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new adm CVE-2025-548766.9The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords i CVE-2025-548775.3Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versi