EUVD-2025-201386CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Analysis
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Technical ContextAI
An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Authentication Bypass by Spoofing (CWE-290).
RemediationAI
Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenti
Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circum
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | released | 25.11.80+git20251121.7090b106-1 |
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| plucky | not-affected | code not present |
| xenial | not-affected | code not present |
| questing | released | 25.08.1-0ubuntu2.1 |
| Release | Status | Version |
|---|---|---|
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| questing | needed | - |
| upstream | released | 70 |
| plucky | ignored | end of life, was needed |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | not-affected | - | - |
| trixie (security), trixie | fixed | 62-1+deb13u1 | - |
| forky, sid | fixed | 71-1 | - |
| trixie | fixed | 62-1+deb13u1 | - |
| (unstable) | fixed | 71-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | not-affected | - | - |
| bookworm | not-affected | - | - |
| trixie (security), trixie | fixed | 25.04.2-1+deb13u1 | - |
| forky, sid | fixed | 25.11.80+git20251121.7090b106-1 | - |
| trixie | fixed | 25.04.2-1+deb13u1 | - |
| (unstable) | fixed | 25.11.80+git20251121.7090b106-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today