Une CWE-306 "Authentification Manquante pour une Fonction Critique" dans maxprofile/accounts/routes.lua dans Q-Free MaxTime inférieur ou égal à la version 2.11.0 permet à un attaquant distant non authentifié de réinitialiser arb

The impact of CVE-2025-26341 is severe due to the ease of exploitation and the potential for widespread account compromise. An attacker could leverage this vulnerability to gain full control over user accounts within the MaxTime system. This could lead to unauthorized access to sensitive data, modification of system configurations, and potentially even complete system takeover. The lack of authentication means no prior knowledge of user credentials is required, making it a highly accessible attack vector. Successful exploitation could result in significant operational disruption and reputational damage.

Organizations utilizing Q-Free MaxTime versions 0 through 2.11.0, particularly those with publicly accessible instances or those lacking robust network segmentation, are at significant risk. Shared hosting environments where multiple users share the same MaxTime instance are also particularly vulnerable.

1. 2025-02-12Disclosure

   disclosure

1. Réservé2025-02-07
2. Publiée2025-02-12
3. Modifiée2025-02-17
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2025-26341 is to immediately upgrade Q-Free MaxTime to version 2.11.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting external access to the password reset endpoint or implementing stricter rate limiting to prevent brute-force attempts. Monitor access logs for suspicious activity, particularly requests to the password reset endpoint. After upgrading, confirm the vulnerability is resolved by attempting a password reset request from an unauthenticated source – it should be rejected.