{"id":"CVE-2025-43863","published":"2025-06-12T17:29:57Z","modified":"2025-06-12T17:54:44Z","title":"vantage6 lacks brute-force protection on change password functionality","vendor":"vantage6","product":"vantage6","tier":"tail","description":{"text":"vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.","provenance":"source","from":"CVE.org"},"cvss":{"score":1.7,"severity":"LOW","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00466,"percentile":0.4033,"provenance":"source"},"cwes":[{"id":"CWE-307","name":"Improper Restriction of Excessive Authentication Attempts"}],"references":[{"url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw","tags":["x_refsource_CONFIRM"]}],"priority":{"score":9.3,"factors":[{"name":"EPSS percentile","points":8.07},{"name":"CVSS severity","points":1.19}]},"vendorSlug":"vantage6","affectedVersions":[{"vendor":"vantage6","product":"vantage6","versions":["< 4.11.0"]}],"affected":[{"ecosystem":"PyPI","package":"vantage6","vulnerableRanges":["<4.11.0"],"patched":["4.11.0"],"from":["GHSA-j6g5-p62x-58hw","PYSEC-2025-220"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-18202","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-23823","published":"2024-03-14","fixed":"4.3.0","kev":false},{"cve":"CVE-2024-24770","published":"2024-03-14","fixed":"4.3.0","kev":false},{"cve":"CVE-2024-32969","published":"2024-05-23","fixed":"4.5.0rc3","kev":false,"link":{"from":"CVE-2024-32969","to":"CVE-2025-43863","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:vantage6","fromFixed":"4.5.0rc3","toFixed":"4.11.0","daysApart":385}]}},{"cve":"CVE-2025-43863","published":"2025-06-12","fixed":"4.11.0","kev":false},{"cve":"CVE-2024-24769","published":"2026-06-17","fixed":"5.0.0","kev":false},{"cve":"CVE-2024-27928","published":"2026-06-17","fixed":"5.0.0","kev":false},{"cve":"CVE-2026-54445","published":"2026-06-17","fixed":"5.0.0","kev":false}],"package":"PyPI:vantage6"}}