Is CVE-2025-71457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71457 being exploited in the wild.

How severe is CVE-2025-71457?

Critical severity, with a CVSS score of 9.8, published 4 November 2026.

Which products and versions are affected?

Vtenext 25.02 before 25.02.1; also affects 20.04, 24.02.

Is there a fix for CVE-2025-71457?

Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71457 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-71457?

Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71457: vtenext authentication bypass in password reset

CVE-2025-71457 · Severity: critical · CVSS 9.8 · Published 2026-11-04

vtenext is a CRM platform used by Italian businesses to manage customer relationships and automate sales workflows. An unauthenticated attacker can reset any user's password through the password recovery page without proper token verification, allowing account takeover and potential administrative access. This enables attackers to log in as any user, including administrators, if two-factor authentication is not enabled.

Technologies: Vtenext. Vendors: Vtenext.

Quick answers

Is CVE-2025-71457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71457 being exploited in the wild.
How severe is CVE-2025-71457?: Critical severity, with a CVSS score of 9.8, published 4 November 2026.
Which products and versions are affected?: Vtenext 25.02 before 25.02.1; also affects 20.04, 24.02.
Is there a fix for CVE-2025-71457?: Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71457 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-71457?: Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: vtenext 25.02.2

Technical details

CVE-2025-71457 is an authentication bypass in the password recovery mechanism (hub/rpwd.php) that fails to properly validate CSRF tokens before processing password changes. An unauthenticated attacker knowing a valid username can send action=change_password to RecoverPwd::displayChangePwd() and reset the target user's password without verification. Combined with additional vectors, this enables complete authentication bypass and remote code execution.

Affected products

vtenext vtenext 25.02 before 25.02.1; also affects 20.04, 24.02

Timeline

2025-08-12: disclosed: Full disclosure by 0xbro after vendor patch release
2025-07-24: patched: Version 25.02.1 included silent patch for arbitrary password reset
2025-08: patched: Version 25.02.2 released with patches for all vectors
2025-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.