CVE-2025-26343: high-severity vulnerability in Q-Free MaxTime
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Q-Free MaxTime versions 2.11.0 and earlier have weak PIN authentication that lets attackers guess user passwords through repeated HTTP requests. This allows unauthorized access to the system without needing valid credentials.
CWE-1390 weak authentication vulnerability in Q-Free MaxTime ≤2.11.0 PIN mechanism enables unauthenticated remote attackers to perform brute-force attacks via crafted HTTP requests. The attack requires no prior authentication and can enumerate valid PINs through multiple successive attempts, leading to unauthorized account access.
In the same product, most dangerous first.