What is the CVSS score of CVE-2025-43866?

CVE-2025-43866 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-43866?

vantage6 servers using auto-generated JWT secrets are vulnerable to token forgery attacks, potentially allowing unauthorized access to privacy-sensitive analysis infrastructure.. A patch is available.

How to fix or mitigate CVE-2025-43866?

Within 24 hours: Audit all vantage6 deployments to identify which instances use auto-generated versus user-defined JWT secrets. Within 7 days: For instances with auto-generated secrets, manually define strong cryptographic JWT secrets and rotate all existing tokens; review access logs for unauthorized token usage. Within 30 days: Upgrade to vantage6 version 4.11.0 or later once patch availability is confirmed, and implement token expiration policies with short lifespans.

Python CVE-2025-43866

EUVD-2025-18201 HIGH

Use of Insufficiently Random Values (CWE-330)

2025-06-12 security-advisories@github.com

GHSA-m3mq-f375-5vgh

Authentication Bypass Python Information Disclosure Vantage6

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18201

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 18:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.

AnalysisAI

vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, allowing attackers to forge authentication tokens and gain unauthorized access to the privacy-preserving analysis platform. This affects all vantage6 versions prior to 4.11.0 where users have not manually defined a strong JWT secret. The vulnerability has a CVSS score of 7.5 with high confidentiality impact, as attackers can impersonate legitimate users without needing privileges or user interaction.

Technical ContextAI

The vulnerability stems from CWE-330 (Use of Insufficiently Random Values), a fundamental cryptographic weakness. vantage6 uses JWT (JSON Web Tokens) for authentication, but the default key generation relies on UUID1 (time-based, MAC-address-based UUIDs defined in RFC 4122) rather than cryptographically secure random generation. UUID1 is deterministic and predictable given knowledge of the timestamp and MAC address, making it unsuitable for cryptographic purposes like JWT signing. An attacker who can predict or brute-force the UUID1 value can generate valid JWTs, bypassing authentication entirely. The affected component is the vantage6 server's JWT initialization module, which generates keys at startup unless explicitly overridden via user configuration.

RemediationAI

Immediate actions: (1) Upgrade vantage6 to version 4.11.0 or later, which implements cryptographically secure random JWT key generation. (2) For systems unable to immediately upgrade, manually set the JWT_SECRET configuration parameter to a strong, cryptographically random value (minimum 256 bits of entropy, generated using tools like openssl rand -base64 32). (3) Rotate all existing JWT tokens and revoke any long-lived tokens issued prior to remediation. (4) Review server logs for suspicious authentication patterns or unauthorized token usage. (5) Consider implementing token expiration policies and rate limiting on token validation endpoints. Organizations should prioritize patching vantage6 instances handling sensitive research or healthcare data within 48-72 hours.