CVE-2025-10161CWE-307CWE-602CWE-807

CVE-2025-10161

High · published November 11, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

⚡ A simple brute force attack can bypass authentication on Perfektive, letting attackers waltz right in and take control! 🔓 Think of it as a hotel with no limit on the number of times a guest can try to enter their room, allowing anyone to just keep trying until they get in — a recipe for disaster if the wrong person shows up! With this vulnerability, an attacker could exploit the authentication bypass and gain unauthorized access to sensitive functionality, potentially leading to data breaches or unauthorized changes within the system. The implications could be absolutely devastating for your users and your reputation!

Put simply

Think of it as a hotel with no limit on the number of times a guest can try to enter their room, allowing anyone to just keep trying until they get in — a recipe for disaster if the wrong person shows up! This vulnerability arises from improper restrictions on excessive authentication attempts, along with a reliance on untrusted inputs for security decisions, making it possible for attackers to exploit the system's weaknesses without any sophisticated tools.

What to do

With this vulnerability, an attacker could exploit the authentication bypass and gain unauthorized access to sensitive functionality, potentially leading to data breaches or unauthorized changes within the system. The implications could be absolutely devastating for your users and your reputation! To remediate this issue, upgrade to Perfektive version 12574 Build 2701 or later immediately. Implement rate limiting on login attempts and ensure that server-side security checks are enforced thoroughly. Regularly review access logs for unusual patterns to catch any attempts early. You've got this! By taking action now, you can turn this potential risk into a secure fortress. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.7th percentile
Weaknesses
CWE-307 · Improper Restriction of Excessive Authentication Attempts; CWE-602 · Client-Side Enforcement of Server-Side Security; CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2025-11-11T18:15Z
References (2)
EPSS history
Timeline
  • 11 NOV 12:42Z
    Authentication Bypass in Turkguven's Perfektive
    cvelistv5