# CVE-2025-43863: vantage6 brute-force protection bypass in change password functionality

Source: https://junglewise.ai/threats/cve-2025-43863-vantage6-brute-force-protection-bypass-in-change-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-12. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2025-43863 · Severity: medium · CVSS 4 · Published 2025-06-12

vantage6 is an open-source framework used to manage and deploy privacy-enhancing technologies like federated learning. A security flaw in the password change feature allows an attacker who has gained access to a user's active session to repeatedly guess the current password without being blocked. If successful, this could allow the attacker to permanently take over the user's account by changing the password to one they control.

Technologies: [vantage6 (PyPI)](https://junglewise.ai/threats/technologies/vantage6). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-43863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-43863 being exploited in the wild.

**How severe is CVE-2025-43863?** Medium severity, with a CVSS score of 4, published 12 June 2025.

**Which products and versions are affected?** vantage6 (PyPI) < 4.11.0, ECOSYSTEM:introduced=0,fixed=4.11.0.

**Is there a fix for CVE-2025-43863?** Yes. vantage6 (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-43863 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-43863?** Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6 (PyPI): upgrade to 4.11.0 or later

  ```sh
  pip install "vantage6>=4.11.0"
  ```


## Technical details

The vantage6 framework suffers from an improper restriction of excessive authentication attempts (CWE-307) within its password change route. While the vulnerability requires an attacker to first obtain an authenticated session, the affected endpoint does not implement rate limiting or account lockout mechanisms when verifying the existing password. An attacker can programmatically submit infinite requests to this route; the system returns a specific error message for incorrect passwords, allowing the attacker to identify the correct password through brute-force. This issue is resolved in version 4.11.0.

## Affected products

- vantage6 vantage6 < 4.11.0

## Identifiers

- CVE-2025-43863
- GHSA-j6g5-p62x-58hw
- PYSEC-2025-220

## Timeline

- 2025-06-12: disclosed
- 2025-06-12: advisory
- 2025-06-12: patched

## References

- [https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw](https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw)
- [https://github.com/vantage6/vantage6/commit/e0f1841b310f6f610e8137db2506cf683ce154d0](https://github.com/vantage6/vantage6/commit/e0f1841b310f6f610e8137db2506cf683ce154d0)
- [https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2025-220.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2025-220.yaml)
- [https://api.github.com/repos/vantage6/vantage6/security-advisories/GHSA-j6g5-p62x-58hw](https://api.github.com/repos/vantage6/vantage6/security-advisories/GHSA-j6g5-p62x-58hw)

## Related threats

- [PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review](https://junglewise.ai/threats/cve-2026-73652-vantage6-algorithm-developer-can-edit-another-developer-s)
- [PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration](https://junglewise.ai/threats/cve-2024-32969-vantage6-collaboration-admins-can-extend-their-influence-by)
- [PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token](https://junglewise.ai/threats/cve-2024-24770-vantage6-vulnerable-to-a-username-timing-attack-on-recover)
- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)