CVE-2025-32898CWE-331

CVE-2025-32898

Medium · published December 5, 2025

CVSS v3.1

4.7

EPSS

Percentile

3.7

In the wild

Unconfirmed

What it is

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00148 · 3.7th percentile
Weakness: CWE-331 · Insufficient Entropy
Published: 2025-12-05T10:16Z

References (2)

https://kde.org/info/security/advisory-20250418-3.txt · [email protected]https://kdeconnect.kde.org · [email protected]

EPSS history

Timeline

05 DEC 00:00Z
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks
cvelistv5