CVE-2025-66270CWE-290

CVE-2025-66270

Medium · published December 5, 2025

CVSS v3.1

4.7

EPSS

Percentile

9.4

In the wild

Unconfirmed

What it is

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00200 · 9.4th percentile
Weakness: CWE-290 · Authentication Bypass by Spoofing
Published: 2025-12-05T11:16Z

References (6)

https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3 · [email protected]https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce · [email protected]https://invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9 · [email protected]https://invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080 · [email protected]https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e · [email protected]https://kde.org/info/security/advisory-20251128-1.txt · [email protected]

EPSS history

Timeline

05 DEC 00:00Z
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets
cvelistv5