Is CVE-2025-71454 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71454 being exploited in the wild.

How severe is CVE-2025-71454?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Is there a fix for CVE-2025-71454?

Yes: fixed in 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71454 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-71454?

Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71454: vtenext CSRF protection bypass in VteCsrf

CVE-2025-71454 · Severity: medium · CVSS 6.5 · Published 2026-11-04

vtenext is a CRM platform used by businesses for sales, marketing, and customer support automation. A flaw in its CSRF protection allows attackers to trick logged-in users into opening a malicious link that performs unauthorized actions on their account, such as modifying settings or data, through a web request that bypasses token validation.

Technologies: Vtenext. Vendors: Vtenext.

Quick answers

Is CVE-2025-71454 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71454 being exploited in the wild.
How severe is CVE-2025-71454?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: Vtenext before 25.02.2.
Is there a fix for CVE-2025-71454?: Yes: fixed in 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71454 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-71454?: Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 25.02.2

Technical details

The csrf_check() function in include/utils/VteCsrf.php fails to validate __csrf_token for non-POST requests, allowing state-changing GET requests to bypass CSRF protection. An attacker can craft a URL containing malicious GET parameters that handlers read from $_REQUEST, causing authenticated users to execute actions without proper token verification. This vulnerability requires user interaction (opening a link) but does not require authentication breach.

Affected products

vtenext vtenext before 25.02.2

Timeline

2025-08-12: disclosed
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.