# CVE-2025-71455: vtenext session identifier disclosure in Touch web service

Source: https://junglewise.ai/threats/cve-2025-71455-vtenext-before-25-02-2-contains-a-session-identifier-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2025-71455 · Severity: medium · CVSS 5.3 · Published 2026-11-04

vtenext is a CRM platform used by businesses to manage customer interactions and automate workflows. The vulnerability allows attackers who can inject scripts into the application—such as through cross-site scripting—to read PHP session identifiers that are supposed to be protected. An attacker exploiting this could hijack authenticated user sessions and gain unauthorized access to the system.

Technologies: [Vtenext](https://junglewise.ai/threats/technologies/vtenext). Vendors: [Vtenext](https://junglewise.ai/threats/vendors/vtenext).

## Quick answers

**Is CVE-2025-71455 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71455 being exploited in the wild.

**How severe is CVE-2025-71455?** Medium severity, with a CVSS score of 5.3, published 4 November 2026.

**Which products and versions are affected?** Vtenext before 25.02.2.

**Is there a fix for CVE-2025-71455?** Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71455 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-71455?** Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in vtenext 25.02.2

## Technical details

The Touch web service endpoint in vtenext before 25.02.2 discloses the PHPSESSID value in a way that bypasses the HttpOnly flag protection. An attacker with the ability to execute JavaScript in the vtenext origin (via XSS or similar) can read this session token and use it to impersonate authenticated users. This is a post-XSS session hijacking vulnerability requiring a preceding script-injection vulnerability.

## Affected products

- vtenext vtenext before 25.02.2

## Timeline

- 2025-08-12: disclosed
- 2025-07-24: patched: Version 25.02.1 silently patched one authentication bypass vector
- 2025-08: patched: Version 25.02.2 patched remaining vulnerabilities
- 2026-11-04: advisory

## References

- [https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/](https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/)
- [https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/](https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/)

## Related threats

- [vtenext authentication bypass in password reset](https://junglewise.ai/threats/cve-2025-71457-vtenext-25-02-before-25-02-1-contains-an-authentication-bypass)
- [vtenext SQL injection in Fax EditView](https://junglewise.ai/threats/cve-2025-71456-vtenext-before-25-02-2-contains-an-sql-injection-vulnerability)
- [vtenext CSRF protection bypass in VteCsrf](https://junglewise.ai/threats/cve-2025-71454-vtenext-before-25-02-2-contains-a-cross-site-request-forgery)
- [vtenext reflected cross-site scripting in Home widget](https://junglewise.ai/threats/cve-2025-71453-vtenext-before-25-02-2-contains-a-reflected-cross-site-scripting)