Log in Start free

Vulnerability · Published Oct 9, 2025 · Assigned by GitHub_M

CVE-2025-61926Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Medium 4.6

In plain English

A medium-severity hard-coded credentials in allstar from ossf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.6Medium
Exploit odds (30 days)0.5%top 56.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/ossf/allstar0.0.0-20250721181116-e004ecb540d6GHSA-33f4-mjch-7fpr
Gogithub.com/ossf/allstar0.0.0-20250721181116-e004ecb540d6GO-2025-4018

Affected products (as reported)

VendorProductVersions
ossf allstar < 0.0.0-20250721181116-e004ecb540d6

Weakness: CWE-453, CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References