What is the CVSS score of CVE-2025-63314?

CVE-2025-63314 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Session Fixation are affected by CVE-2025-63314?

Organizations using the password reset function of DDSN Interactive Acora CMS face critical risk from CVE-2025-63314, a weak password recovery vulnerability rated CVSS 10.0.

How to fix or mitigate CVE-2025-63314?

Within 24 hours: Identify all affected systems running the password reset function of DDSN Interactive Acora CMS and apply vendor patches immediately. Monitor vendor channels for patch availability.

Session Fixation CVE-2025-63314

CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-01-12 cve@mitre.org

Authentication Bypass Session Fixation Cm3 Acora Cms

10.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 12, 2026 - 17:15 nvd

CRITICAL 10.0

DescriptionNVD

A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

AnalysisAI

Acora CMS v10.7.1 uses a static, predictable password reset token. Attackers can replay this token to reset any user's password and take over their account, including admin accounts. Maximum CVSS 10.0 with scope change.

Technical ContextAI

The password reset function uses a fixed token (CWE-640) instead of generating unique, time-limited tokens per request. Any attacker who discovers or guesses this static token can reset any user's password indefinitely.

RemediationAI

Implement cryptographically random, single-use, time-limited password reset tokens.

CVE-2025-63314 vulnerability details – vuln.today

Back