# CVE-2025-71457: vtenext authentication bypass in password reset

Source: https://junglewise.ai/threats/cve-2025-71457-vtenext-25-02-before-25-02-1-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2025-71457 · Severity: critical · CVSS 9.8 · Published 2026-11-04

vtenext is a CRM platform used by Italian businesses to manage customer relationships and automate sales workflows. An unauthenticated attacker can reset any user's password through the password recovery page without proper token verification, allowing account takeover and potential administrative access. This enables attackers to log in as any user, including administrators, if two-factor authentication is not enabled.

Technologies: [Vtenext](https://junglewise.ai/threats/technologies/vtenext). Vendors: [Vtenext](https://junglewise.ai/threats/vendors/vtenext).

## Quick answers

**Is CVE-2025-71457 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71457 being exploited in the wild.

**How severe is CVE-2025-71457?** Critical severity, with a CVSS score of 9.8, published 4 November 2026.

**Which products and versions are affected?** Vtenext 25.02 before 25.02.1; also affects 20.04, 24.02.

**Is there a fix for CVE-2025-71457?** Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71457 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-71457?** Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in vtenext 25.02.2

## Technical details

CVE-2025-71457 is an authentication bypass in the password recovery mechanism (hub/rpwd.php) that fails to properly validate CSRF tokens before processing password changes. An unauthenticated attacker knowing a valid username can send action=change_password to RecoverPwd::displayChangePwd() and reset the target user's password without verification. Combined with additional vectors, this enables complete authentication bypass and remote code execution.

## Affected products

- vtenext vtenext 25.02 before 25.02.1; also affects 20.04, 24.02

## Timeline

- 2025-08-12: disclosed: Full disclosure by 0xbro after vendor patch release
- 2025-07-24: patched: Version 25.02.1 included silent patch for arbitrary password reset
- 2025-08: patched: Version 25.02.2 released with patches for all vectors
- 2025-11-04: advisory

## References

- [https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/](https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/)
- [https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/](https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/)

## Related threats

- [vtenext SQL injection in Fax EditView](https://junglewise.ai/threats/cve-2025-71456-vtenext-before-25-02-2-contains-an-sql-injection-vulnerability)
- [vtenext session identifier disclosure in Touch web service](https://junglewise.ai/threats/cve-2025-71455-vtenext-before-25-02-2-contains-a-session-identifier-disclosure)
- [vtenext CSRF protection bypass in VteCsrf](https://junglewise.ai/threats/cve-2025-71454-vtenext-before-25-02-2-contains-a-cross-site-request-forgery)
- [vtenext reflected cross-site scripting in Home widget](https://junglewise.ai/threats/cve-2025-71453-vtenext-before-25-02-2-contains-a-reflected-cross-site-scripting)