CVE-2025-5409 json
Mist Community Edition API Token views.py create_token access control
published 2025-06-01 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16588
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The identifier of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.
Patch / fix
- mist mist 4.7.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Stolichnayer/mist-ce-account-takeover referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Mist Community Edition
Classification
References
-
github.com
/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad
patch
-
github.com
/mistio/mist-ce/releases/tag/v4.7.2
patch, release-notes
-
github.com
/Stolichnayer/mist-ce-account-takeover
exploit, third-party-advisory
-
vuldb.com
/?id.310749
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.310749
signature, permissions-required, vdb-entry
-
vuldb.com
/?submit.583531
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2025-5409
- NVD CVE-2025-5409
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.