Apache Fineract CVE-2025-23408

Exploitation requires that Apache Fineract (version 1.10.1 or earlier) is running with its pre-1.11.0 password policy, which did not enforce sufficient password strength/complexity, allowing accounts to be protected by weak passwords that are feasible to guess or brute-force. Per the vendor CVSS 4.0 vector, a low-privilege authenticated foothold is indicated (PR:L), and no user interaction is needed (UI:N); the attack is network-reachable with low complexity (AV:N/AC:L). Limiting factors: the weakness is only meaningful where weak passwords are actually in use and where account lockout/rate-limiting or external IdP/SSO controls are not compensating, and it is fully remediated by upgrading to 1.11.0 or later (1.13.0 recommended).

This is a CWE-521 Weak Password Requirements flaw in Apache Fineract (through 1.10.1), meaning the platform permitted passwords that failed to meet adequate complexity/strength policy, lowering the bar for credential-guessing and brute-force attacks. The only CVSS provided is a vendor CVSS 4.0 base vector (8.5 / High) with AV:N, AC:L, AT:N, PR:L, UI:N and notably high subsequent-system impact (SC:H/SI:H/SA:H) alongside high vulnerable-system confidentiality (VC:H) - consistent with a compromised weak credential enabling broad access to a banking backend. The signals are mixed: severity is High and the vector is network/low-complexity, but PR:L shows some authenticated foothold is required, and EPSS is only 0.52% (42nd percentile), indicating low modeled near-term exploitation probability. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation - this reads as a defense-in-depth/credential-policy hardening issue rather than an imminently weaponized remote flaw. Note a tension to verify: a Weak Password Requirements class weakness normally rates PR:N (the attacker is guessing another user's credential), yet the vendor assigned PR:L; this likely reflects that an authenticated/registered context is needed to reach the affected password-setting flow - confirm the exploitation path with Apache before relying on the PR assignment.

An attacker with a low-privilege Fineract account (or who can register one) sets or encounters accounts protected by weak, policy-non-compliant passwords and performs automated credential-guessing/brute-force against higher-value accounts of this core banking platform. No public exploit code is identified; the attack relies on standard brute-force tooling over the network against a low-complexity authentication surface, and success yields access to sensitive financial data (VC:H) and downstream banking systems (SC:H/SI:H/SA:H).