Vulnerability · Published Oct 8, 2025 · Assigned by VulDB

CVE-2025-11438JhumanJ OpnForm API Endpoint custom-domains authorization

Medium 6.3

In plain English

A medium-severity missing authorization in OpnForm from JhumanJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoint. Such manipulation leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is beb153ce52dceb971c1518f98333328c95f1ba20. It is best practice to apply a patch to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
JhumanJ	OpnForm	1.9.01.9.11.9.21.9.3

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-327375 | JhumanJ OpnForm API Endpoint custom-domains authorization vdb-entry
VDB-327375 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #666879 | GitHub OpnForm 1.9.3 Improper Access Controls third-party-advisory
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys exploit
https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20 issue-tracking, patch