CVE-2025-66270

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....

4.7 MediumFix available

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.21%Up 0.2 points since Dec 5, 2025

What each source reports

CVE List Score used 4.7

Record: CVE-2025-66270
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-290
Updated: 2026-11-02

EUVDEUVD-2025-201386 4.7

Record: EUVD-2025-201386
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xcg9-fw4f-9chv 4.7

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....

Record: GHSA-xcg9-fw4f-9chv
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-290
Updated: 2026-11-02

NVD 4.7

Record: CVE-2025-66270
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-290
Updated: 2026-11-02

OSV 4.7

Record: CVE-2025-66270
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-290
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-66270 4.7

Record: DEBIAN-CVE-2025-66270
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-66270 4.7

Record: UBUNTU-CVE-2025-66270
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15800-1 No score

kdeconnect-kde-25.11.90-1.1 on GA media

These are all security issues fixed in the kdeconnect-kde-25.11.90-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15800-1
Updated: 2026-11-02

OSVUSN-7905-1 No score

kdeconnect vulnerability

It was discovered that KDE Connect incorrectly handled device IDs. An attacker could possibly use this issue to bypass authentication and connect an unpaired device.

Record: USN-7905-1
Updated: 2026-11-02

Affected products

kde connect protocol

Affected packages

Affected packages
Package	Affected	Fixed
`gnome-shell-extension-gsconnect` Debian:13	before 62-1+deb13u1, plus listed versions 62-1	62-1+deb13u1
`gnome-shell-extension-gsconnect` Debian:14	before 71-1, plus listed versions 62-167-167-2	71-1
`kdeconnect` Debian:13	before 25.04.2-1+deb13u1, plus listed versions 25.04.2-1	25.04.2-1+deb13u1
`kdeconnect` Debian:14	before 25.11.80+git20251121.7090b106-1, plus listed versions 25.04.2-125.08.1-1	25.11.80+git20251121.7090b106-1
`gnome-shell-extension-gsconnect` Ubuntu:25.10	All versions, plus listed versions 62-162-1ubuntu167-1	None known
`kdeconnect` Ubuntu:25.10	before 25.08.1-0ubuntu2.1, plus listed versions 24.12.3-0ubuntu225.04.0-0ubuntu125.04.0-0ubuntu225.04.1-0ubuntu125.04.2-0ubuntu2 Show 7 moreShow less 25.04.2-1ubuntu125.04.3-0ubuntu125.07.80-0ubuntu125.07.90-0ubuntu125.08.0-0ubuntu125.08.1-0ubuntu125.08.1-0ubuntu2	25.08.1-0ubuntu2.1
`kdeconnect-kde` openSUSE:Tumbleweed	before 25.11.90-1.1	25.11.90-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66270 is a medium vulnerability (CVSS 4.7) in Kde Connect Protocol, published November 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in gnome-shell-extension-gsconnect 62-1+deb13u1.

References

Show 8 moreShow less