# CVE-2025-12871: The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to…

Source: https://junglewise.ai/threats/cve-2025-12871-the-a-hrd-developed-by-aenrich-has-an-authentication-abuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-12  
License: CC BY 4.0 with a link back

CVE-2025-12871 · Severity: critical · CVSS 9.8 · Published 2025-11-12

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.

Technologies: [Aenrich A\+Hrd](https://junglewise.ai/threats/technologies/a-hrd). Vendors: [Aenrich](https://junglewise.ai/threats/vendors/aenrich).

## Quick answers

**Is CVE-2025-12871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12871 being exploited in the wild.

**How severe is CVE-2025-12871?** Critical severity, with a CVSS score of 9.8, published 12 November 2025.

**Which products and versions are affected?** Aenrich A\+Hrd. The advisory does not name versions.

**Is there a fix for CVE-2025-12871?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-12871?** Check whether you run Aenrich A\+Hrd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Aenrich A\+Hrd

## Related threats

- [The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to…](https://junglewise.ai/threats/cve-2025-12870-the-a-hrd-developed-by-aenrich-has-an-authentication-abuse)
- [The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with…](https://junglewise.ai/threats/cve-2025-12869-the-a-hrd-developed-by-aenrich-has-a-stored-cross-site-scripting)