CVE-2025-62398

MediumCVSS 5.4/10Last modified Nov 5, 2026

Description

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
—	—	>= 5.0.0, < 5.0.3; >= 4.5.0, < 4.5.7; >= 4.4.0, < 4.4.11

References

https://access.redhat.com/security/cve/CVE-2025-62398Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2404431Issue Tracking, Third Party Advisory

Timeline

Published: Oct 23, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-623997.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible t CVE-2025-62405.0Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profis CVE-2025-624006.5Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could re CVE-2025-624014.3An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowe CVE-2025-624025.4API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the e CVE-2025-624037.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-624048.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624058.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624068.8Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows send CVE-2025-624076.1Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument CVE-2025-624085.9c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer(CVE-2025-624097.5Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can