fushengqian fuint Authentication Token ClientSignController.java authorization

published 2025-11-03 12 mo ago modified 2026-10-18 21 d ago also EUVD-2025-37478

cvss: 3.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 12 mo ago (2025-11-03)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/fushengqian/fuint/issues/67 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA	3.0	3.1	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA	2.0	2.1	AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
CNA	4.0	1.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	2.0	2.1	AV:N/AC:H/Au:S/C:P/I:N/A:N

Affected products

fushengqian fuint

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-285 Improper Authorization

References

github.com /fushengqian/fuint/issues/67
exploit, issue-tracking
vuldb.com /?id.330915
vdb-entry
vuldb.com /?ctiid.330915
signature, permissions-required
vuldb.com /?submit.678911
third-party-advisory

Sources

CVE List CVE-2025-12623
NVD CVE-2025-12623

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary