CVE-2025-71457

Name of the Vulnerable Software and Affected Versions vtenext versions 25.02 through 25.02.0

Description An authentication bypass allows unauthenticated attackers to change any account password via the 'hub/rpwd.php' endpoint. By providing a valid user name and sending action=change password to the RecoverPwd::displayChangePwd() function, an attacker can reset passwords without token verification. This can lead to unauthorized access to administrator accounts that do not have two-factor authentication enabled.

Recommendations Update to version 25.02.1.