CVE-2025-66432CWE-420

CVE-2025-66432

Medium · published November 30, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-420 · Unprotected Alternate Channel
Published
2025-11-30T10:16Z
References (3)
https://docs.oxide.computer/security/advisories/20251117-1 · [email protected]https://github.com/oxidecomputer/omicron/compare/01bb875...ec069f0 · [email protected]https://oxide.computer/ · [email protected]
EPSS history
Timeline
  • 30 NOV 00:00Z
    In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date
    cvelistv5