GTT Tax Information System CVE-2025-13953

Exploitation requires that the GTT Tax Information System is deployed using the Active Directory (LDAP) login method, where authentication is brokered through a LOCAL WebSocket that the web application fails to validate for origin/authenticity. The concrete prerequisite is attacker access to the local machine running the application OR a position on the internal network from which the local WebSocket can be impersonated - this is the primary limiting factor and means the flaw is not exploitable from the open internet despite the AV:N in the vendor vector. No valid domain credentials and no user interaction are required once that network/host position is obtained.

Signals conflict and should be reconciled before prioritization. The vendor-supplied CVSS 4.0 vector scores 9.3 (Critical) with AV:N/AC:L/PR:N/UI:N and full High impact to confidentiality, integrity and availability, which on its face looks like trivially remote, unauthenticated, total compromise. However, the description explicitly scopes the attacker to one 'with access to the local machine or internal network' who must impersonate a LOCAL WebSocket - this contradicts AV:N and is far more consistent with an adjacent/local attack vector. CVSS network vector conflicts with the description's local/internal-network precondition - treat this as adjacent-access, not internet-facing, and verify with the vendor/INCIBE. The supporting exploitation signals are modest: EPSS is only 0.57% (46th percentile), there is no CISA KEV listing (not actively exploited per available data), and no public exploit identified at time of analysis. Net assessment: this is a genuinely high-impact authentication bypass (CWE-290, spoofing of a trusted authentication channel) that fully defeats access control when an attacker already has a foothold on the host or LAN, but the real-world urgency is tempered by the local/internal-network precondition, low EPSS, absence of KEV, and a niche, industry-specific product. Prioritize patching for exposed/shared deployments, but it is not a mass-exploitation internet threat on current evidence.

An attacker who already has a foothold on the internal network or the local host running the GTT Tax Information System stands up a rogue process impersonating the legitimate local authentication WebSocket. Because the web application never validates the authenticity or origin of the WebSocket data, the attacker injects a forged Active Directory/LDAP identity and is logged in as any chosen domain user with no valid credentials. No public exploit code has been identified at time of analysis.