CVE-2025-71457 · Other
NO FIX YET · SEE WHAT TO DO
vtenext 25.02 before 25.02.1 has an authentication bypass in hub/rpwd.php that lets anyone change any account's password without a reset token. An attacker who knows a valid username can log in as administrators who do not use two-factor authentication.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted vtenext CRM instances running 25.02 before 25.02.1 that expose the hub/rpwd.php endpoint. Instances behind a network restriction or already on 25.02.1 are not exposed. Admin accounts without two-factor authentication are the easiest targets.
Not affected if already-on-25.02.1, endpoint-not-internet-reachable
Who cares php, self-hosted, vtenext
25.02 builds below 25.02.1 are in the affected range.hub/rpwd.php is reachable from the internet on your instance.25.02.1 (fixed release, per the advisory's affected range).vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.