What is the CVSS score of CVE-2025-49006?

CVE-2025-49006 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2025-49006?

Wasp framework versions before 0.16.6 contain an OAuth/OpenID Connect flaw that improperly lowercases user IDs during authentication, creating user impersonation and account collision risks…. A patch is available.

How to fix or mitigate CVE-2025-49006?

Within 24 hours: Identify all Wasp framework deployments and verify Keycloak configuration for case-sensitive user ID settings. Within 7 days: upgrade Wasp framework to version 0.16.6 or later across all affected environments. Within 30 days: conduct post-upgrade authentication testing, particularly for users with similar names differing only in case, and review access logs for anomalous account access patterns during the vulnerable period.

Node.js CVE-2025-49006

EUVD-2025-17468 HIGH

Incorrect Default Permissions (CWE-276)

2025-06-09 security-advisories@github.com

Node.js Privilege Escalation Google

8.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:43 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.16.6

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17468

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 13:15 nvd

HIGH 8.2

DescriptionGitHub Advisory

Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation (affecting only Keycloak with a specific config). Wasp currently lowercases OAuth user IDs before storing / fetching them. This behavior violates OAuth and OpenID Connect specifications and can result in user impersonation, account collisions, and privilege escalation. In practice, out of the OAuth providers that Wasp auth supports, only Keycloak is affected. Keycloak uses a lowercase UUID by default, but users can configure it to be case sensitive, making it affected. Google, GitHub, and Discord use numerical IDs, making them not affected. Users should update their Wasp version to 0.16.6 which has a fix for the problematic behavior. Users using Keycloak can work around the issue by not using a case sensitive user ID in their realm configuration.

AnalysisAI

Wasp framework versions prior to 0.16.6 contain a critical OAuth/OpenID Connect implementation flaw where user IDs are improperly lowercased before storage and authentication, violating specification requirements. This affects only Keycloak deployments configured with case-sensitive user IDs, enabling attackers to impersonate users, trigger account collisions, and escalate privileges. While the CVSS score of 8.2 reflects high integrity impact, real-world risk is constrained to Keycloak with specific non-default configuration, and no public exploit or KEV designation has been reported.

Technical ContextAI

The vulnerability exists in Wasp's OAuth authentication layer, which implements OpenID Connect provider integration for frameworks using React, Node.js, and Prisma. The root cause (CWE-276: Incorrect Default Permissions) manifests as improper handling of user identity claims during OAuth token exchange. Specifically, Wasp converts user IDs to lowercase during the authentication flow (lines handling user_id claims from OAuth providers) before persisting them to the Prisma ORM layer. OAuth 2.0 and OpenID Connect specifications (RFC 6749, OpenID Connect Core 1.0) treat user IDs as case-sensitive opaque strings; lowercasing violates this contract. Keycloak, by default, generates UUID-based user IDs in lowercase, rendering the flaw invisible unless administrators explicitly enable case-sensitive ID configuration in the realm settings. Competing providers (Google, GitHub, Discord) use purely numerical IDs, which are unaffected by case-folding operations. The vulnerability enables collision attacks where two distinct Keycloak users with IDs differing only in case (e.g., 'abcd-1234' vs 'ABCD-1234') would map to the same Wasp user account post-authentication.

RemediationAI

Primary remediation: Update Wasp to version 0.16.6 or later. The patch removes the lowercasing operation on OAuth user ID claims, preserving case sensitivity in alignment with OAuth/OpenID Connect specifications. For Wasp users unable to upgrade immediately: Workaround via Keycloak configuration—disable case-sensitive user IDs in the Keycloak realm settings, ensuring all user IDs are generated and stored in lowercase, thereby neutralizing the collision vector (this matches Keycloak's default behavior and is the recommended interim mitigation). Secondary mitigation: Conduct account audit on affected Wasp instances to identify any user accounts created from Keycloak with differing case variants; merge or isolate such accounts pending upgrade. Refer to Wasp GitHub releases (github.com/wasp-lang/wasp/releases/tag/0.16.6) for detailed patch notes and deployment instructions.