What is the CVSS score of CVE-2025-29419?

CVE-2025-29419 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of CTFd are affected by CVE-2025-29419?

CTFd v3.7.6 is vulnerable to man-in-the-middle attacks on shared networks, allowing unauthenticated attackers to intercept session tokens and credentials from competitors and organizers.

How to fix or mitigate CVE-2025-29419?

Within 24 hours, verify which CTFd instances run version 3.7.6 and assess whether they operate on isolated networks or shared LAN/Wi-Fi segments. Within 7 days, deploy compensating controls such as enforcing HTTPS with valid certificates for all CTFd communications, requiring VPN access for all participants, or implementing network segmentation to separate CTFd traffic from general event networks. Within 30 days, contact Capture The Flag organizers to establish a timeline for upgrading to a patched version when available, or evaluate alternative CTF platforms if CTFd remains unpatched.

CTFd CVE-2025-29419

EUVD-2025-210783 HIGH

Channel Accessible by Non-Endpoint (CWE-300)

2026-08-26 mitre

GHSA-q57q-64xf-mphf

Information Disclosure N A

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Adjacent-network vector confirmed by MITM class; no attacker authentication required; high confidentiality loss from session interception; limited integrity impact only.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 31, 2026 - 20:36 vuln.today

CVSS changed

Aug 31, 2026 - 18:22 NVD

7.1 (HIGH)

CVE Published

Aug 26, 2026 - 00:00 cve.org

HIGH 7.1

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.

AnalysisAI

Man-in-the-middle interception in CTFd v3.7.6, a widely-used Capture The Flag competition platform, exposes high-confidentiality data to adjacent-network attackers with no authentication required. Rooted in CWE-300 (Channel Accessible by Non-Endpoint), the flaw allows an attacker sharing the same network segment to intercept communications, capturing sensitive data such as session tokens or credentials, with limited integrity modification also possible. No active exploitation is confirmed - EPSS sits at 0.15% (4th percentile) and no CISA KEV listing exists - but the attack surface is acutely relevant in live CTF event environments where competitors and organizers routinely share the same LAN or Wi-Fi.

Technical ContextAI

CTFd is an open-source web-based platform for hosting Capture The Flag cybersecurity competitions, maintained at github.com/CTFd/CTFd. CWE-300 (Channel Accessible by Non-Endpoint) identifies that the communication channel between clients and the CTFd server can be intercepted by a non-endpoint party - indicating either absent or improperly enforced transport encryption (TLS), or a scenario where sensitive data traverses an unprotected channel. The CVSS vector AV:A confirms that exploitation is constrained to the adjacent network (same LAN, WLAN, or broadcast domain), consistent with layer-2 MITM techniques such as ARP spoofing. A reference to the QingdaoU/OnlineJudge repository appears in the disclosure references, suggesting a possible shared codebase or dependency relationship, though this connection is not confirmed. CPE data in the NVD record is listed as 'n/a:n/a:*', meaning formal product enumeration has not been completed for this entry.

RemediationAI

No patched version of CTFd has been identified from the available references at the time of analysis; the vendor's GitHub repository (https://github.com/CTFd/CTFd) and official site (http://ctfd.com) should be monitored for a security release addressing CVE-2025-29419. As an immediate compensating control, operators should enforce HTTPS-only access by placing CTFd behind a TLS-terminating reverse proxy (e.g., nginx, Caddy, or Traefik) configured with a valid certificate authority-signed certificate and HTTP-to-HTTPS redirection - this eliminates the primary interception surface with minimal operational impact. Network isolation is a second control: restrict CTFd to a dedicated VLAN or network segment that separates the server from untrusted participant traffic, raising the bar for layer-2 MITM attacks; this is especially important during live competition events. HTTP Strict Transport Security (HSTS) headers should also be configured to prevent protocol downgrade. These controls mitigate exploitation risk but do not resolve the root-cause vulnerability in the application itself.