CVE-2025-32898

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore...

4.7 MediumFix available

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.16%Up 0.1 points since Dec 5, 2025

What each source reports

CVE List Score used 4.7

Record: CVE-2025-32898
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-331
Updated: 2026-11-02

EUVDEUVD-2025-201337 4.7

Record: EUVD-2025-201337
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r3v4-hrwm-cxm5 4.7

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore...

Record: GHSA-r3v4-hrwm-cxm5
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-331
Updated: 2026-11-02

NVD 4.7

Record: CVE-2025-32898
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-331
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-32898 4.7

Record: DEBIAN-CVE-2025-32898
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-32898 4.7

Record: UBUNTU-CVE-2025-32898
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

kde connect verification-code protocol

Affected packages

Affected packages
Package	Affected	Fixed
`gnome-shell-extension-gsconnect` Debian:12	All versions, plus listed versions 54-255-155-255-355-4 Show 12 moreShow less 56-157-157-257-358-158-258-362-167-167-271-172-1	None known
`gnome-shell-extension-gsconnect` Debian:13	before 62-1	62-1
`gnome-shell-extension-gsconnect` Debian:14	before 62-1	62-1
`kdeconnect` Debian:12	All versions, plus listed versions 22.12.3-123.08.2-123.08.5-124.08.2-124.08.3-1 Show 11 moreShow less 24.08.3-224.12.0-125.04.0+git20250504.28fb9142-125.04.0-125.04.2-125.08.1-125.11.80+git20251121.7090b106-125.12.3-126.04.0-126.04.3-126.04.3-2	None known
`kdeconnect` Debian:13	before 25.04.0-1	25.04.0-1
`kdeconnect` Debian:14	before 25.04.0-1	25.04.0-1
`kdeconnect` Ubuntu:16.04:LTS	All versions, plus listed versions 0.8-0ubuntu5	None known
`kdeconnect` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.3-0ubuntu21.2.1-0ubuntu11.2.1-0ubuntu21.3.0-0ubuntu11.3.1-0ubuntu0.11.3.3-0ubuntu0.18.04.1	None known
`gnome-shell-extension-gsconnect` Ubuntu:20.04:LTS	All versions, plus listed versions 20-0ubuntu1	None known
`kdeconnect` Ubuntu:20.04:LTS	All versions, plus listed versions 1.3.5-0ubuntu11.4-0ubuntu11.4-0ubuntu21.4-0ubuntu31.4-0ubuntu41.4-0ubuntu5	None known

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`gnome-shell-extension-gsconnect` Ubuntu:22.04:LTS	All versions, plus listed versions 20-0ubuntu248-0ubuntu248-0ubuntu348-0ubuntu450-0ubuntu1	None known
`kdeconnect` Ubuntu:22.04:LTS	All versions, plus listed versions 21.08.1-0ubuntu121.08.1-0ubuntu221.08.3-0ubuntu121.08.3-1ubuntu121.11.80-0ubuntu1 Show 6 moreShow less 21.11.90-0ubuntu121.11.90-0ubuntu221.12.0-0ubuntu121.12.1-0ubuntu121.12.2-0ubuntu121.12.3-0ubuntu1	None known
`gnome-shell-extension-gsconnect` Ubuntu:24.04:LTS	All versions, plus listed versions 55-456-157-1	None known
`kdeconnect` Ubuntu:24.04:LTS	All versions, plus listed versions 23.08.1-0ubuntu123.08.2-0ubuntu123.08.3-0ubuntu123.08.4-0ubuntu123.08.5-0ubuntu123.08.5-0ubuntu423.08.5-0ubuntu5	None known
`kdeconnect` Ubuntu:25.10	All versions, plus listed versions 24.12.3-0ubuntu225.04.0-0ubuntu125.04.0-0ubuntu225.04.1-0ubuntu125.04.2-0ubuntu2 Show 8 moreShow less 25.04.2-1ubuntu125.04.3-0ubuntu125.07.80-0ubuntu125.07.90-0ubuntu125.08.0-0ubuntu125.08.1-0ubuntu125.08.1-0ubuntu225.08.1-0ubuntu2.1	None known
`kdeconnect` Ubuntu:26.04:LTS	All versions, plus listed versions 25.08.1-0ubuntu225.08.2-0ubuntu225.08.3-0ubuntu125.11.80-0ubuntu125.11.80-0ubuntu2 Show 7 moreShow less 25.11.90-0ubuntu125.12.0-0ubuntu125.12.1-0ubuntu125.12.1-0ubuntu225.12.2-0ubuntu125.12.2-0ubuntu325.12.3-0ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-32898 is a medium vulnerability (CVSS 4.7) in Kde Connect Verification-code Protocol, published December 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in gnome-shell-extension-gsconnect 62-1.