Executive brief
vantage6 is an open-source framework used to manage and deploy privacy-enhancing technologies like federated learning. A security flaw in the password change feature allows an attacker who has gained access to a user's active session to repeatedly guess the current password without being blocked. If successful, this could allow the attacker to permanently take over the user's account by changing the password to one they control.
Technical details
The vantage6 framework suffers from an improper restriction of excessive authentication attempts (CWE-307) within its password change route. While the vulnerability requires an attacker to first obtain an authenticated session, the affected endpoint does not implement rate limiting or account lockout mechanisms when verifying the existing password. An attacker can programmatically submit infinite requests to this route; the system returns a specific error message for incorrect passwords, allowing the attacker to identify the correct password through brute-force. This issue is resolved in version 4.11.0.
Affected products
- vantage6 vantage6 < 4.11.0
Timeline
- 2025-06-12: disclosed
- 2025-06-12: advisory
- 2025-06-12: patched
References
- https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw
- https://github.com/vantage6/vantage6/commit/e0f1841b310f6f610e8137db2506cf683ce154d0
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2025-220.yaml
- https://api.github.com/repos/vantage6/vantage6/security-advisories/GHSA-j6g5-p62x-58hw