What is the CVSS score of CVE-2025-67418?

CVE-2025-67418 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of ClipBucket are affected by CVE-2025-67418?

ClipBucket 5.5.2 ships with hardcoded default administrative credentials, allowing any unauthenticated network user to gain complete administrative control of the video-sharing platform.

Is there a public PoC exploit available for CVE-2025-67418?

Yes, a public proof-of-concept exploit is available for CVE-2025-67418. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-67418?

Within 24 hours: Isolate ClipBucket 5.5.2 from internet access using firewall rules, or take the service offline; confirm no unauthorized access to administrative functions by reviewing login logs. Within 7 days: Audit all ClipBucket admin panel logs since deployment for account creation, configuration changes, and data access; notify affected users if unauthorized administrative activity is confirmed. Within 30 days: Monitor vendor security advisories for ClipBucket 5.5.3 or later; immediately deploy when available. If no patch is released within 30 days, evaluate replacing ClipBucket with an alternative video-sharing solution or maintain only in air-gapped environment if operationally critical.

ClipBucket CVE-2025-67418

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2025-12-22 cve@mitre.org

Authentication Bypass Clipbucket Oxygenz

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Default credentials are network-reachable and require no earned privileges or interaction (AV:N/AC:L/PR:N/UI:N); admin takeover yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:33 vuln.today

DescriptionCVE.org

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.

AnalysisAI

Full administrative takeover of ClipBucket 5.5.2 is possible because the video-sharing platform ships with hardcoded default administrative credentials, letting any unauthenticated remote attacker sign into the admin panel and control the entire application. Publicly available exploit material (a Medium write-up) documents the attack, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N). This is a network-reachable, no-interaction flaw, though EPSS is modest at 0.57% (43rd percentile) and it is not currently listed in CISA KEV.

Technical ContextAI

ClipBucket is an open-source PHP-based video-sharing/streaming CMS (vendor identified in CPE as oxygenz:clipbucket). The root cause is CWE-798, Use of Hard-coded Credentials: the distribution embeds a fixed administrator username/password that is present in every default deployment rather than being generated or forced to change on first setup. Because these static credentials are the same across all installations, knowledge of the default pair - which is discoverable from documentation, source, or the published write-up - functions as a universal backdoor into the administrative interface. The CPE string cpe:2.3:a:oxygenz:clipbucket with a wildcard version indicates the affected build is the 5.5.2 line as stated in the description.

RemediationAI

No vendor-released patch or fixed version was identified at time of analysis, so remediation centers on eliminating the default credentials directly: immediately change the administrator username and password from the shipped defaults on every ClipBucket 5.5.2 instance, and verify no other accounts retain default secrets. As compensating controls, restrict access to the administrative panel (e.g., the /admin_area or CMS admin path) to known management IPs via web-server allowlisting or a reverse proxy, and place the admin interface behind a VPN or HTTP authentication gateway - the trade-off is added friction for legitimate administrators and possible breakage of remote management workflows. Monitor authentication logs for successful admin logins from unexpected sources. Consult the referenced write-up (https://medium.com/@arpit03sharma2003/cve-2025-67418-when-default-credentials-become-a-remote-root-button-03be5ee4b927) for the specific default credential values to ensure they are rotated, and track the vendor's channels for an official patched release.