CVE-2025-55796

The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openml	Product
https://github.com/openml/openml.org	Product
https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openml:openml_frontend:*:*:*:*:*:*:*:*

History

29 Sep 2026, 14:41

Type	Values Removed	Values Added
First Time		Openml openml Frontend
CPE	cpe:2.3:a:openml:openml.org::::::::	cpe:2.3:a:openml:openml_frontend::::::::

Information

Published : 2025-11-18 17:16

Updated : 2026-09-29 14:41

NVD link : CVE-2025-55796

Mitre link : CVE-2025-55796

CVE.ORG link : CVE-2025-55796

JSON object : View

Products Affected

openml

openml_frontend

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-55796", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55796", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T17:11:29.165177Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-11-18T17:16:04.270", "references": [{"url": "https://github.com/openml", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/openml/openml.org", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as \"%d %H:%M:%S\" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover."}], "lastModified": "2026-09-29T14:41:38.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openml:openml_frontend:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C8D60C6-5A9B-4550-96BC-D3F7085D4CB7", "versionEndExcluding": "2.0.20251111"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}