CVE-2025-6505

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-65079.8A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrar CVE-2025-650737.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke CVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious att CVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabili CVE-2025-650789.3An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabilit CVE-2025-650796.9A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability CVE-2025-65084.3The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding CVE-2025-650806.9A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be lever CVE-2025-650816.9An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be CVE-2025-650826.5Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the