CVE-2025-32788: OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

CVE-2025-32788 · Severity: low · CVSS 3.1 · Published 2025-04-22

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.

Technologies: OctoPrint (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-32788 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32788 being exploited in the wild.
How severe is CVE-2025-32788?
Low severity, with a CVSS score of 3.1, published 22 April 2025.
Which products and versions are affected?
OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.0, GIT:introduced=0,fixed=41ff431014edfa18ca1a01897b10463934dc7fc2|ECOSYSTEM:introduced=0,fixed=1.11.0.
Is there a fix for CVE-2025-32788?
Yes. OctoPrint (PyPI): upgrade to 1.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-32788?
Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • OctoPrint (PyPI): upgrade to 1.11.0 or later
    pip install "OctoPrint>=1.11.0"

Affected products

  • OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.0, GIT:introduced=0,fixed=41ff431014edfa18ca1a01897b10463934dc7fc2|ECOSYSTEM:introduced=0,fixed=1.11.0

Identifiers

  • CVE-2025-32788
  • GHSA-qw93-h6pf-226x
  • PYSEC-2025-56

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.