Is CVE-2025-13804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13804 being exploited in the wild.

How severe is CVE-2025-13804?

Medium severity, with a CVSS score of 4.3, published 1 December 2025.

Which products and versions are affected?

org.nutz:nutzboot-parent (Maven) ECOSYSTEM:introduced=0,last_affected=2.6.0-SNAPSHOT; NutzBoot up to 2.6.0-SNAPSHOT.

Is there a fix for CVE-2025-13804?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13804 attacked?

It is attacked over the network.

Am I affected by CVE-2025-13804?

Check whether you run org.nutz:nutzboot-parent (Maven) or NutzBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13804: Nutz NutzBoot information disclosure in Ethereum Wallet Handler

CVE-2025-13804 · Severity: medium · CVSS 4.3 · Published 2025-12-01

NutzBoot is a Java-based application framework that includes Ethereum wallet functionality. A vulnerability in the Ethereum Wallet Handler component allows unauthenticated remote attackers to retrieve sensitive information, including wallet passwords, through improper access controls on the local accounts API. This could enable attackers to compromise cryptocurrency wallets and steal funds or other digital assets.

Technologies: org.nutz:nutzboot-parent (Maven). Vendors: Maven.

Quick answers

Is CVE-2025-13804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13804 being exploited in the wild.
How severe is CVE-2025-13804?: Medium severity, with a CVSS score of 4.3, published 1 December 2025.
Which products and versions are affected?: org.nutz:nutzboot-parent (Maven) ECOSYSTEM:introduced=0,last_affected=2.6.0-SNAPSHOT; NutzBoot up to 2.6.0-SNAPSHOT.
Is there a fix for CVE-2025-13804?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13804 attacked?: It is attacked over the network.
Am I affected by CVE-2025-13804?: Check whether you run org.nutz:nutzboot-parent (Maven) or NutzBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in the Ethereum Wallet Handler component of NutzBoot, specifically affecting the Web3j integration in the nutzboot-demo-simple-web3j module. An unauthenticated remote attacker can access the /local/accounts API endpoint without proper authorization checks, allowing retrieval of sensitive wallet data including passwords. The vulnerable code path is in EthModule.java. The attack requires only network reachability to the exposed API endpoint and no authentication. Exploitation results in complete exposure of wallet credentials and associated sensitive information. Patched versions beyond 2.6.0-SNAPSHOT are expected to implement proper authorization controls on the accounts API.

Affected products

Nutz NutzBoot up to 2.6.0-SNAPSHOT

Identifiers

CVE-2025-13804
GHSA-qp56-qj59-hjf8

Timeline

2025-12-01: disclosed
exploited: Public exploit released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.