CVE-2025-49591highCWE-284CWE-287

CVE-2025-49591: fallo de gravedad alta en cryptpad

CryptPad 2FA Bypass Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear cryptpad

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.5%
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
cryptpad · cryptpad
CVEs relacionadas — cryptpad

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49590LOWCryptPad Dom-Based Cross-Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-26028MEDIUMCryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSSEPSS 0.2%