Vulnerability · Published Mar 3, 2025 · Assigned by GitHub_M
CVE-2025-27422FACTION Allows Authentication Bypass via User Creation
High 7.5
In plain English
A high-severity improper authentication in faction from factionsecurity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| factionsecurity | faction | < 1.4.3 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N