CVE-2025-43863: vantage6 brute-force protection bypass in change password functionality

CVE-2025-43863 · Severity: medium · CVSS 4 · Published 2025-06-12

vantage6 is an open-source framework used to manage and deploy privacy-enhancing technologies like federated learning. A security flaw in the password change feature allows an attacker who has gained access to a user's active session to repeatedly guess the current password without being blocked. If successful, this could allow the attacker to permanently take over the user's account by changing the password to one they control.

Technologies: vantage6 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-43863 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-43863 being exploited in the wild.
How severe is CVE-2025-43863?
Medium severity, with a CVSS score of 4, published 12 June 2025.
Which products and versions are affected?
vantage6 (PyPI) < 4.11.0, ECOSYSTEM:introduced=0,fixed=4.11.0.
Is there a fix for CVE-2025-43863?
Yes. vantage6 (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43863 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-43863?
Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vantage6 (PyPI): upgrade to 4.11.0 or later
    pip install "vantage6>=4.11.0"

Technical details

The vantage6 framework suffers from an improper restriction of excessive authentication attempts (CWE-307) within its password change route. While the vulnerability requires an attacker to first obtain an authenticated session, the affected endpoint does not implement rate limiting or account lockout mechanisms when verifying the existing password. An attacker can programmatically submit infinite requests to this route; the system returns a specific error message for incorrect passwords, allowing the attacker to identify the correct password through brute-force. This issue is resolved in version 4.11.0.

Affected products

  • vantage6 vantage6 < 4.11.0

Identifiers

  • CVE-2025-43863
  • GHSA-j6g5-p62x-58hw
  • PYSEC-2025-220

Timeline

  • 2025-06-12: disclosed
  • 2025-06-12: advisory
  • 2025-06-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.