ByteOS Network

CVE Vulnerability Details :

CVE-2025-55299

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-18 Aug, 2025 | 17:36

Updated At-18 Aug, 2025 | 17:54

▼CVE Numbering Authority (CNA)

VaulTLS has a password-based login exploit in additional user accounts

VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1.

Affected Products

Vendor

7ritn

Product

VaulTLS

Versions

Affected

< 0.9.1

Problem Types

Type	CWE ID	Description
CWE	CWE-521	CWE-521: Weak Password Requirements

Metrics

Version	Base score	Base severity	Vector
3.1	9.4	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

Hyperlink	Resource
https://github.com/7ritn/VaulTLS/security/advisories/GHSA-pjfr-pj3h-cw8m	x_refsource_CONFIRM
https://github.com/7ritn/VaulTLS/commit/6ac0a43a768f1753f6889ba43f914e773a4b45c0	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References