CVE-2025-27580CWE-335

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed…

High · published April 23, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00710 · 53.0th percentile
Weakness
CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Published
2025-04-23T00:00Z
EPSS history
Timeline
  • 23 APR 00:00Z
    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed…
    cvelistv5