CVE-2025-9520CWE-639

IDOR Leading to Owner Account Hijacking in Omada Controller

High · published January 26, 2026

CVSS v4.0
8.3
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
EPSS
0.00439 · 37.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-01-26T19:34Z
EPSS history
Timeline
  • 26 JAN 19:34Z
    IDOR Leading to Owner Account Hijacking in Omada Controller
    cvelistv5