CVE-2025-40571

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40571

2.2 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

A

vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions < V3.3.0). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-726617.html
Configurations

No configuration.

History

11 Nov 2025, 21:15

Type Values Removed Values Added
Summary (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions < V3.3.0). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.

12 Jun 2025, 08:15

Type Values Removed Values Added
Summary (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 9 compatible) (All versions). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.

22 May 2025, 14:16

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una vulnerabilidad en Mendix OIDC SSO (compatible con Mendix 10) (todas las versiones anteriores a la V4.0.0) y Mendix OIDC SSO (compatible con Mendix 9) (todas las versiones). El módulo Mendix OIDC SSO otorga acceso de lectura y escritura a todos los tokens exclusivamente al rol de administrador, lo que podría provocar un uso indebido de privilegios por parte de un atacante que modifique el módulo durante el desarrollo de Mendix.
Summary (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.0.0), Mendix OIDC SSO (Mendix 9 compatible) (All versions). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. (en) A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 9 compatible) (All versions). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.

13 May 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-13 10:15

Updated : 2025-11-11 21:15

NVD link : CVE-2025-40571

Mitre link : CVE-2025-40571

CVE.ORG link : CVE-2025-40571

JSON object : View

Products Affected

No product.

CWE
CWE-266

Incorrect Privilege Assignment