Executive brief
Vimesoft Enterprise Video Platform, a system used by organizations to manage and stream video content, contains a security flaw that allows unauthorized users to bypass login requirements. This could allow an attacker to access sensitive video data or administrative functions without a valid username or password. The vulnerability impacts versions 3.11.0.0 through 3.25.0, potentially leading to data exposure and unauthorized access to corporate media assets.
Technical details
A missing authentication vulnerability (CWE-306) exists in the Vimesoft Enterprise Video Platform within the version range 3.11.0.0 to 3.25.0. The flaw allows a remote, unauthenticated attacker to bypass security controls and access critical functions or sensitive data by sending specially crafted network requests. The vulnerability is rated with a CVSS score of 7.5, reflecting high confidentiality impact but no direct impact on integrity or availability according to the provided vector. Organizations should update to version 3.25.0 or later to remediate the issue.
Affected products
- Vimesoft Inc. Enterprise Video Platform 3.11.0.0 to 3.25.0
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory