CVE-2025-9803

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-863

Affected software

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	>= unspecified, < 1.9.35

References

https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91Broken Link
https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6Exploit, Third Party Advisory
https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6Exploit, Third Party Advisory

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98046.5An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOA CVE-2025-98057.5A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of t CVE-2025-98066.4A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the c CVE-2025-98077.5The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and incl CVE-2025-98085.3The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST CVE-2025-98099.8Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary CVE-2025-98105.8TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race b CVE-2025-98119.8A vulnerability was found in Campcodes Farm Management System 1.0. This affects an unknown part of the file /reviewInput.php. Performing man CVE-2025-98128.8A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand.CVE-2025-98138.8A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The CVE-2025-98149.8A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/c CVE-2025-98157.8A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file Privilege