CVE-2025-3091CWE-639

MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24

High · published June 24, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-06-24T08:10Z
EPSS history
Timeline
  • 24 JUN 08:10Z
    MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24
    cvelistv5