CVE-2025-26342: critical vulnerability in Q-Free MaxTime
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A critical security flaw in Q-Free MaxTime allows anyone on the internet to create new user accounts, including admin accounts, without needing to log in first. This lets attackers take complete control of the system.
CWE-306 vulnerability in maxprofile/accounts/routes.lua permits unauthenticated HTTP requests to execute user creation functions, enabling arbitrary account provisioning including administrative privileges. Affects Q-Free MaxTime ≤2.11.0; exploitation requires network access to the vulnerable endpoint with no authentication barriers.
In the same product, most dangerous first.