CVE-2025-71457

Received Received - Intake

Authentication Bypass in vtenext CRM via Password Reset

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2025-71457

EUVD

EUVD-2025-211255

Affected Vendors & Products

Vendor	Product	Version / Range
vtenext	vtenext	25.02

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-620	When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

Executive Summary

CVE-2025-71457 is an authentication bypass flaw in vtenext versions before 25.02.1. It allows unauthenticated attackers to change any user's password via the hub/rpwd.php endpoint without token verification. Attackers only need a valid username to send a change_password request and gain unauthorized access, including to admin accounts without two-factor authentication.

Detection Guidance

Check for unauthorized password change attempts via the hub/rpwd.php endpoint. Monitor logs for POST requests to /hub/rpwd.php with action=change_password and no token verification. Inspect vtenext versions prior to 25.02.1 for this activity.

Impact Analysis

This vulnerability enables attackers to take over any account by resetting passwords, including admin accounts. They can then access sensitive data, perform unauthorized actions, or escalate privileges. Systems lacking two-factor authentication for admins are at higher risk of full compromise.

Mitigation Strategies

Upgrade vtenext to version 25.02.1 or later immediately. Block access to hub/rpwd.php endpoint if not required. Enable two-factor authentication for all administrator accounts. Review logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2025-71457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...