maxprofile/accounts/routes.lua में एक CWE-306 "महत्वपूर्ण फ़ंक्शन के लिए गुम प्रमाणीकरण" Q-Free MaxTime संस्करण 2.11.0 से कम या उसके बराबर में, एक अप्रमाणित दूरस्थ हमलावर को arb रीसेट करने की अनुमति देता है।

The impact of CVE-2025-26341 is severe due to the ease of exploitation and the potential for widespread account compromise. An attacker could leverage this vulnerability to gain full control over user accounts within the MaxTime system. This could lead to unauthorized access to sensitive data, modification of system configurations, and potentially even complete system takeover. The lack of authentication means no prior knowledge of user credentials is required, making it a highly accessible attack vector. Successful exploitation could result in significant operational disruption and reputational damage.

Organizations utilizing Q-Free MaxTime versions 0 through 2.11.0, particularly those with publicly accessible instances or those lacking robust network segmentation, are at significant risk. Shared hosting environments where multiple users share the same MaxTime instance are also particularly vulnerable.

1. 2025-02-12Disclosure

   disclosure

1. आरक्षित2025-02-07
2. प्रकाशित2025-02-12
3. संशोधित2025-02-17
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-26341 is to immediately upgrade Q-Free MaxTime to version 2.11.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting external access to the password reset endpoint or implementing stricter rate limiting to prevent brute-force attempts. Monitor access logs for suspicious activity, particularly requests to the password reset endpoint. After upgrading, confirm the vulnerability is resolved by attempting a password reset request from an unauthenticated source – it should be rejected.