Log in Start free

Vulnerability · Published Jul 24, 2025 · Assigned by GitHub_M

CVE-2025-53940Quiet uses insecure, inconsistent verification on local backend token

High 8.5

In plain English

A high-severity security flaw in quiet from TryQuiet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High
Exploit odds (30 days)4.2%top 9.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.

Affected products (as reported)

VendorProductVersions
TryQuiet quiet < 6.0.1

Weakness: CWE-208 · Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

References