Man-in-the-Middle Attack in CTFd v3.7.6

Publication date: 2026-08-26

Last updated on: 2026-08-31

Assigner: MITRE

Description

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-31

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2025-29419

EUVD

EUVD-2025-210783

Affected Vendors & Products

Vendor	Product	Version / Range
ctfd	ctfd	3.7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-300	The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Attack-Flow Graph

Executive Summary

CTFd v3.7.6 is vulnerable to a man-in-the-middle attack, where an attacker intercepts communication between users and the system to steal or alter data.

Impact Analysis

This vulnerability could allow attackers to eavesdrop on sensitive data, modify transmitted information, or impersonate users, potentially leading to data breaches or unauthorized access.

Hi! I’m here to help you understand CVE-2025-29419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70