High · published December 12, 2025
⚡ A sneaky flaw in IBM Aspera Orchestrator lets users change others' passwords without knowing them — that's like granting a secret key to your safe without asking for the combination! 🔑 Think of it as a party where anyone can just stroll up and change the guest list without the host's approval. This vulnerability allows authenticated users to step in and alter another user's password without even a hint of the original password needed. This could lead to unauthorized access, allowing an attacker to hijack accounts and wreak havoc — imagine your guests suddenly getting kicked out while an intruder takes control of the party! The ability to change a user's password could compromise sensitive data and disrupt operations.
Think of it as a party where anyone can just stroll up and change the guest list without the host's approval. This vulnerability allows authenticated users to step in and alter another user's password without even a hint of the original password needed. CVE-2025-13148 affects IBM Aspera Orchestrator versions 4.0.0 through 4.1.0, allowing authenticated users to change another user's password without verification, which violates proper security protocols.
This could lead to unauthorized access, allowing an attacker to hijack accounts and wreak havoc — imagine your guests suddenly getting kicked out while an intruder takes control of the party! The ability to change a user's password could compromise sensitive data and disrupt operations. To protect your environment, upgrade to the latest version of Aspera Orchestrator immediately. Review user permissions and implement strict controls on password changes to ensure only authorized personnel can execute such actions. This is fixable! Follow these steps and secure your setup like a true security champion! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ibm/aspera_orchestrator | ≥ 4.0.0, < 4.1.1 | 4.1.1 |