CVE-2025-15097
Improper Authentication Vulnerability in Alteryx Server API Endpoint
Publication date: 2025-12-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| alteryx | server | 2024.1.1.9.236 |
| alteryx | server | 2023.1.1.13.486 |
| alteryx | server | 2025.1.1.1.31 |
| alteryx | server | 2024.2.1.6.125 |
| alteryx | server | 2023.2.1.10.293 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15097 is a critical authentication bypass vulnerability in Alteryx Server affecting the /gallery/api/status/ endpoint. It allows remote attackers to bypass normal authentication mechanisms without valid credentials by exploiting improper authentication handling. This means an attacker can gain unauthorized access to the server, potentially impersonating users and accessing sensitive functions. The vulnerability affects multiple versions from 2020 through 2024, with patches available starting from version 2023.1.1.13.486 and later. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to Alteryx Server, allowing attackers to bypass authentication controls and gain access to sensitive data and system functions. An attacker can obtain valid session IDs and user details, enabling them to perform privileged actions such as creating users or manipulating data. This compromises the confidentiality, integrity, and availability of the system, potentially resulting in full system compromise. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending specific HTTP requests to the Alteryx Server API endpoints and analyzing the responses. A practical detection method involves: 1) Sending a GET request to the /api/status/ endpoint to retrieve the server version. 2) Sending a POST request to /api/auth/sessions/ with the JSON payload {"scheme":"windows","parameters":[]} to test for authentication bypass. If the server responds with a JSON object containing a valid sessionId and user details (subscriptionId, email, role), it indicates the system is vulnerable. Example commands using curl: 1) curl -X GET https://<server_address>/api/status/ 2) curl -X POST https://<server_address>/api/auth/sessions/ -H "Content-Type: application/json" -d '{"scheme":"windows","parameters":[]}' A successful response with session details confirms the vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Alteryx Server to one of the patched versions that address this vulnerability. The fixed versions are 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125, and 2025.1.1.1.31. Upgrading to any of these versions will resolve the improper authentication issue. If upgrading immediately is not possible, consider restricting access to the affected API endpoints (/gallery/api/status/ and /api/auth/sessions/) via network controls or firewalls to limit exposure until a patch can be applied. [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.