CVE-2025-31991

Analyzed Analyzed - Analysis Complete

Improper Rate Limiting in HCL DevOps Velocity Enables Brute-Force

Publication date: 2026-04-13

Last updated on: 2026-07-07

Assigner: HCL Software

Description

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-13

Last Modified

2026-07-07

Generated

2026-07-26

AI Q&A

2026-04-13

EPSS Evaluated

2026-07-25

NVD

CVE-2025-31991

EUVD

EUVD-2025-209421

Affected Vendors & Products

Vendor	Product	Version / Range
hcltech	devops_velocity	to 5.1.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability occurs because the rate limiting mechanism for user login attempts in HCL DevOps Velocity is not properly enforced. As a result, attackers can perform brute-force attacks by repeatedly trying to log in past the limit of unsuccessful login attempts.

This issue is addressed and fixed in version 5.1.7 of HCL DevOps Velocity.

Impact Analysis

The vulnerability allows attackers to perform brute-force attacks on user login credentials, potentially leading to unauthorized access to user accounts.

While the confidentiality of data is not directly impacted (as indicated by the CVSS score), the integrity of the system can be compromised because attackers may gain control over user accounts.

Compliance Impact

The vulnerability allows brute-force attacks due to improper enforcement of rate limiting on user login attempts. This can lead to unauthorized access or compromise of user accounts.

Such unauthorized access risks can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HCL DevOps Velocity to version 5.1.7 where the issue is fixed.

Hi! I’m here to help you understand CVE-2025-31991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70