Is CVE-2025-43866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-43866 being exploited in the wild.

How severe is CVE-2025-43866?

Medium severity, with a CVSS score of 4, published 12 June 2025.

Which products and versions are affected?

vantage6-server (PyPI) < 4.11.0, ECOSYSTEM:introduced=0,fixed=4.11.0.

Is there a fix for CVE-2025-43866?

Yes. vantage6-server (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-43866 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-43866?

Check whether you run vantage6-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-43866: Vantage6 Server insufficiently random JWT secret key

Q: Is there a fix for CVE-2025-43866?

Yes. vantage6-server (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-43866 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-43866?

Check whether you run vantage6-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-43866 · Severity: medium · CVSS 4 · Published 2025-06-12

Vantage6 is an open-source platform used for privacy-preserving data analysis. A security issue was identified where the server's default security keys (JWT secrets) are generated using a predictable method if not manually configured by the user. This could potentially allow an attacker to guess the security key, leading to unauthorized access or the ability to forge authentication tokens.

Technologies: vantage6-server (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-43866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-43866 being exploited in the wild.
How severe is CVE-2025-43866?: Medium severity, with a CVSS score of 4, published 12 June 2025.
Which products and versions are affected?: vantage6-server (PyPI) < 4.11.0, ECOSYSTEM:introduced=0,fixed=4.11.0.
Is there a fix for CVE-2025-43866?: Yes. vantage6-server (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43866 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-43866?: Check whether you run vantage6-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vantage6-server (PyPI): upgrade to 4.11.0 or later
```
pip install "vantage6-server>=4.11.0"
```

Technical details

The vantage6-server component uses Python's `uuid.uuid1()` to auto-generate a `JWT_SECRET_KEY` when one is not explicitly provided in the configuration. Because UUID1 is based on the host's MAC address and the current timestamp, it is not cryptographically secure and is partially predictable. An attacker who can predict the secret key could forge JSON Web Tokens (JWTs) to bypass authentication or escalate privileges. The vulnerability is classified as CWE-330 (Use of Insufficiently Random Values) and has been addressed in version 4.11.0 by switching to a more secure random generator.

Affected products

vantage6 vantage6-server < 4.11.0

Identifiers

CVE-2025-43866
GHSA-m3mq-f375-5vgh
PYSEC-2025-221

Timeline

2025-06-12: disclosed
2025-06-12: advisory
2025-06-12: patched: Fixed in version 4.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.