# CVE-2025-32788: OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

Source: https://junglewise.ai/threats/cve-2025-32788-octoprint-authenticated-reverse-proxy-page-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-22  
License: CC BY 4.0 with a link back

CVE-2025-32788 · Severity: low · CVSS 3.1 · Published 2025-04-22

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.

Technologies: [OctoPrint (PyPI)](https://junglewise.ai/threats/technologies/octoprint). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-32788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32788 being exploited in the wild.

**How severe is CVE-2025-32788?** Low severity, with a CVSS score of 3.1, published 22 April 2025.

**Which products and versions are affected?** OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.0, GIT:introduced=0,fixed=41ff431014edfa18ca1a01897b10463934dc7fc2|ECOSYSTEM:introduced=0,fixed=1.11.0.

**Is there a fix for CVE-2025-32788?** Yes. OctoPrint (PyPI): upgrade to 1.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-32788?** Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- OctoPrint (PyPI): upgrade to 1.11.0 or later

  ```sh
  pip install "OctoPrint>=1.11.0"
  ```


## Affected products

- OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.0, GIT:introduced=0,fixed=41ff431014edfa18ca1a01897b10463934dc7fc2|ECOSYSTEM:introduced=0,fixed=1.11.0

## Identifiers

- CVE-2025-32788
- GHSA-qw93-h6pf-226x
- PYSEC-2025-56

## Related threats

- [OctoPrint stored XSS in connection parameters](https://junglewise.ai/threats/cve-2026-123364-octoprint-provides-a-web-interface-for-controlling-consumer-3d)
- [OctoPrint file exfiltration via query parameters in upload endpoints](https://junglewise.ai/threats/cve-2026-54134-octoprint-file-exfiltration-via-query-parameters-in-upload)
- [OctoPrint XSS in Suppressed Command Notifications](https://junglewise.ai/threats/cve-2026-35163-octoprint-xss-in-suppressed-command-notifications)
- [PYSEC-2026-1716 - OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication](https://junglewise.ai/threats/cve-2026-23892-octoprint-has-timing-side-channel-vulnerability-in-api-key)
- [PYSEC-2026-1714 - OctoPrint vulnerable to XSS in Action Commands Notification and Prompt](https://junglewise.ai/threats/cve-2025-64187-octoprint-vulnerable-to-xss-in-action-commands-notification-and)