{"id":"CVE-2025-40554","aliases":["EUVD-2025-206480","GHSA-jm7r-g967-8pch"],"status":"published","title":"SolarWinds Web Help Desk Authentication Bypass Vulnerability","description":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.60642,"percentile":0.99152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1390"],"published":"2026-01-28T07:36:50Z","modified":"2026-06-17T09:21:44Z","exploits":[{"source":"nuclei","id":"CVE-2025-40554","title":"SolarWinds Web Help Desk - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40554.yaml"},{"source":"pocgithub","id":"Skynoxk/CVE-2025-40554","title":"Skynoxk/CVE-2025-40554","date":"2026-01-31","url":"https://github.com/Skynoxk/CVE-2025-40554"},{"source":"pocgithub","id":"imbas007/auth-bypass-CVE-2025-40554","title":"imbas007/auth-bypass-CVE-2025-40554","date":"2026-01-29","url":"https://github.com/imbas007/auth-bypass-CVE-2025-40554"}],"products":[{"vendor":"solarwinds","product":"web help desk"},{"vendor":"solarwinds","product":"web_help_desk"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm","tags":["release-notes","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40554"},{"url":"https://github.com/advisories/GHSA-jm7r-g967-8pch"}],"sources":{"cve":[{"id":"CVE-2025-40554","title":"SolarWinds Web Help Desk Authentication Bypass Vulnerability","description":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.","status":"published","published":"2026-01-28T07:36:50.177Z","modified":"2026-02-26T15:04:48.174Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-206480","description":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.","status":"published","published":"2026-01-28T07:36:50Z","modified":"2026-02-26T15:04:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:26.495238Z"}],"ghsa":[{"id":"GHSA-jm7r-g967-8pch","title":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability...","description":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.","status":"published","published":"2026-01-28T09:30:31Z","modified":"2026-01-28T09:30:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T15:05:57.071513Z"}],"nvd":[{"id":"CVE-2025-40554","description":"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.","status":"published","published":"2026-01-28T08:16:02.737Z","modified":"2026-06-17T09:21:44.8Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:11:59.073638Z"}]}}