CVE-2025-9803

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91	Broken Link
https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6	Exploit Third Party Advisory
https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:1.9.34:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) lunary-ai/lunary versión 1.9.34 es vulnerable a una toma de control de cuenta debido a una autenticación impropia en la integración de Google OAuth. La aplicación no verifica el campo 'aud' (audiencia) en el token de acceso emitido por Google, lo cual es crucial para asegurar que el token está destinado a la aplicación. Este descuido permite a los atacantes usar tokens emitidos a aplicaciones maliciosas para obtener acceso no autorizado a las cuentas de usuario. El problema se resuelve en la versión 1.9.35.

Information

Published : 2025-11-25 01:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-9803

Mitre link : CVE-2025-9803

CVE.ORG link : CVE-2025-9803

JSON object : View

Products Affected

lunary

lunary

CWE

CWE-287

Improper Authentication

CWE-863

Incorrect Authorization

{"id": "CVE-2025-9803", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9803", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T18:35:13.605035Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "lunary-ai", "product": "lunary-ai/lunary", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "1.9.35", "versionType": "custom"}]}]}], "published": "2025-11-25T01:15:47.137", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91", "tags": ["Broken Link"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35."}, {"lang": "es", "value": "lunary-ai/lunary versi\u00f3n 1.9.34 es vulnerable a una toma de control de cuenta debido a una autenticaci\u00f3n impropia en la integraci\u00f3n de Google OAuth. La aplicaci\u00f3n no verifica el campo 'aud' (audiencia) en el token de acceso emitido por Google, lo cual es crucial para asegurar que el token est\u00e1 destinado a la aplicaci\u00f3n. Este descuido permite a los atacantes usar tokens emitidos a aplicaciones maliciosas para obtener acceso no autorizado a las cuentas de usuario. El problema se resuelve en la versi\u00f3n 1.9.35."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:1.9.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBC1BC36-360C-4FAC-8583-40F9D8B2F90C"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}