CVE-2025-8855

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0396
https://www.usom.gov.tr/bildirim/tr-25-0396

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Omisión de autorización mediante clave controlada por el usuario, mecanismo débil de recuperación de contraseña para contraseña olvidada, vulnerabilidad de omisión de autenticación mediante datos asumidos como inmutables en Optimus Software Brokerage Automation permite explotar la confianza en el cliente, omisión de autenticación y manipular información del registro. Este problema afecta a Brokerage Automation: versiones anteriores a la 1.1.71.

Information

Published : 2025-11-14 13:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-8855

Mitre link : CVE-2025-8855

CVE.ORG link : CVE-2025-8855

JSON object : View

Products Affected

No product.

CWE

CWE-302

Authentication Bypass by Assumed-Immutable Data

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2025-8855", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8855", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-14T13:20:09.506876Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "iletisim@usom.gov.tr", "affectedData": [{"vendor": "Optimus Software", "product": "Brokerage Automation", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.71", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-14T13:15:45.337", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0396", "source": "iletisim@usom.gov.tr"}, {"url": "https://www.usom.gov.tr/bildirim/tr-25-0396", "source": "iletisim@usom.gov.tr"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "description": [{"lang": "en", "value": "CWE-302"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.\n\nThis issue affects Brokerage Automation: before 1.1.71."}, {"lang": "es", "value": "Omisi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario, mecanismo d\u00e9bil de recuperaci\u00f3n de contrase\u00f1a para contrase\u00f1a olvidada, vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n mediante datos asumidos como inmutables en Optimus Software Brokerage Automation permite explotar la confianza en el cliente, omisi\u00f3n de autenticaci\u00f3n y manipular informaci\u00f3n del registro. Este problema afecta a Brokerage Automation: versiones anteriores a la 1.1.71."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "iletisim@usom.gov.tr"}