CVE-2025-55796

{
  "id": "CVE-2025-55796",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-18T17:16:04.270",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as \"%d %H:%M:%S\" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover."
    },
    {
      "lang": "es",
      "value": "La aplicación web openml/openml.org versión v2.0.20241110 utiliza tokens predecibles basados en MD5 para flujos de trabajo críticos de usuario, como la confirmación de registro, restablecimientos de contraseña, reenvíos de confirmación de correo electrónico y confirmación de cambio de correo electrónico. Estos tokens se generan mediante el hashing de la marca de tiempo actual formateada como “%d %H:%M:%S” sin incorporar ningún dato específico del usuario ni aleatoriedad criptográfica. Esta predictibilidad permite a atacantes remotos forzar por fuerza bruta tokens válidos dentro de una pequeña ventana de tiempo, lo que permite la confirmación de cuenta no autorizada, restablecimientos de contraseña y aprobaciones de cambio de correo electrónico, lo que podría llevar a la toma de control de la cuenta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-18T17:11:29.165177Z",
          "id": "CVE-2025-55796",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openml:openml_frontend:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.0.20251111",
              "matchCriteriaId": "9C8D60C6-5A9B-4550-96BC-D3F7085D4CB7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openml",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/openml/openml.org",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}