CVE-2023-25156

Kiwi TCMS has no protection against brute-force attacks on login page

7.5 HighFix available

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.91%Down 0.1 points since Feb 16, 2023

What each source reports

CVE List Score used 7.5

Kiwi TCMS has no protection against brute-force attacks on login page

Record: CVE-2023-25156
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2023-0650 7.5

Record: EUVD-2023-0650
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7968-h4m4-ghm9 7.5

No protection against brute-force attacks on login page

Impact

Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

Patches

Users should upgrade to v12.0 or later.

Workarounds

Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

References

Disclosed by spyata

Record: GHSA-7968-h4m4-ghm9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-307
Updated: 2026-11-02

NVD 7.5

Record: CVE-2023-25156
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-770, CWE-307
Updated: 2026-11-02

OSV 7.5

Kiwi TCMS has no protection against brute-force attacks on login page

Record: CVE-2023-25156
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-7968-h4m4-ghm9 7.5

No protection against brute-force attacks on login page

Impact

Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

Patches

Users should upgrade to v12.0 or later.

Workarounds

Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

References

Disclosed by spyata

Record: GHSA-7968-h4m4-ghm9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-307
Updated: 2026-11-02

OSVPYSEC-2026-835 7.5

No protection against brute-force attacks on login page

Impact

Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

Patches

Users should upgrade to v12.0 or later.

Workarounds

Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

References

Disclosed by spyata

Record: PYSEC-2026-835
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`kiwitcms` PyPI	before 12.0	12.0
`kiwitcms` PyPI	before 12.0, plus listed versions 10.010.110.210.310.3.999 Show 39 moreShow less 10.410.511.011.111.311.411.511.611.76.106.116.2.16.36.46.56.5.36.66.76.86.97.07.17.27.2.17.38.08.18.1.998.28.38.48.58.68.6.18.78.88.99.09.999	12.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25156 is a high vulnerability (CVSS 7.5) in Kiwitcms Kiwi, published February 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in kiwitcms 12.0.