CVE-2025-12868criticalCWE-603

CVE-2025-12868: critical vulnerability in CyberTutor New Site Server

CyberTutor｜New Site Server - Use of Client-Side Authentication

Published

Follow this CVE+ Monitor NewSiteServer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.6%
In short

The CyberTutor New Site Server relies on authentication checks only in the browser, not on the server. Attackers can bypass this by modifying the website code to gain admin access without valid credentials.

Technical detail

CWE-603 Use of Client-Side Authentication vulnerability allows unauthenticated remote attackers to manipulate frontend authentication logic (via browser developer tools or proxy interception) to escalate privileges to administrator level. The server lacks server-side authentication validation, enabling privilege escalation without credential compromise.

Summary generated and translated by AI from the official description.
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
CyberTutor · New Site Server