Is CVE-2025-4129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-4129 being exploited in the wild.

How severe is CVE-2025-4129?

High severity, with a CVSS score of 7.5, published 21 July 2025.

Which products and versions are affected?

PAVO Inc. Pay before 13.05.2025.

Is there a fix for CVE-2025-4129?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-4129 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-4129?

Check whether you run PAVO Inc. Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-4129: PAVO Inc. PAVO Pay authorization bypass via user-controlled key

CVE-2025-4129 · Severity: high · CVSS 7.5 · Published 2025-07-21

PAVO Pay, a payment processing solution, contains a security flaw that allows unauthorized access to sensitive information. By manipulating specific identifiers in web requests, an attacker can bypass security checks to view data belonging to other users or the system. This could lead to the exposure of private financial or customer records, potentially impacting the organization's compliance and reputation.

Technologies: PAVO Inc. Pay. Vendors: PAVO Inc..

Quick answers

Is CVE-2025-4129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-4129 being exploited in the wild.
How severe is CVE-2025-4129?: High severity, with a CVSS score of 7.5, published 21 July 2025.
Which products and versions are affected?: PAVO Inc. Pay before 13.05.2025.
Is there a fix for CVE-2025-4129?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-4129 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-4129?: Check whether you run PAVO Inc. Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639) exists in PAVO Pay versions prior to 13.05.2025. The vulnerability occurs when the application uses a user-supplied input to access a record or object without sufficiently verifying that the user has the necessary permissions for that specific identifier. A remote, unauthenticated attacker can exploit this by modifying parameters (such as account IDs or transaction keys) in a network request to access sensitive data they are not authorized to view. The CVSS score of 7.5 reflects high confidentiality impact with no requirement for privileges or user interaction.

Affected products

PAVO Inc. PAVO Pay before 13.05.2025

Timeline

2025-07-21: disclosed
2025-07-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.