CVE-2025-71457

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

9.3 Critical

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.44%Unchanged since Nov 5, 2026

What each source reports

CVE List Score used 9.3

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

Record: CVE-2025-71457
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-620
Updated: 2026-11-05

EUVDEUVD-2025-211255 9.3

Record: EUVD-2025-211255
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-05

GitHub AdvisoriesGHSA-v286-fq46-38fw 9.3

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows...

Record: GHSA-v286-fq46-38fw
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-620
Updated: 2026-11-04

NVD 9.3

Record: CVE-2025-71457
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-620
Updated: 2026-11-05

Affected products

vtenext

History

History
Recorded	Changed	Sources
Nov 5, 2026	published	EUVD
Nov 4, 2026	published	EUVD, NVD
Nov 4, 2026	aliases, published	EUVD
Nov 4, 2026	first indexed	CVE List, GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-71457 is a critical vulnerability (CVSS 9.3) in Vtenext, published November 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. No source names a fixed version.