CVE-2025-26499
BaseFortify
Publication date: 2025-09-11
Last updated on: 2025-09-15
Assigner: WindRiver
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wind_river | studio_developer | 24.11 |
| wind_river | studio_developer | 25.05 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-270 | The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition that occurs under heavy system utilization during authentication or token refresh. It can cause one user to be mistakenly granted an authentication token meant for another user, allowing impersonation until the session ends. Exploitation requires concurrent actions by two users and cannot be intentionally triggered.
How can this vulnerability impact me? :
If this vulnerability occurs, a user may inadvertently gain access to another user's system rights and data, leading to unauthorized access and potential data exposure until the session ends.