What is the CVSS score of CVE-2025-69246?

CVE-2025-69246 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Raytha are affected by CVE-2025-69246?

Organizations using Raytha CMS does not have any brute force protection mechanism implemented. It should be aware of notable risk from CVE-2025-69246 rated CVSS 6.9.. A patch is available.

How to fix or mitigate CVE-2025-69246?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Raytha CVE-2025-69246

EUVD-2025-208717 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-16 CERT-PL

Information Disclosure Raytha

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.6

EUVD ID Assigned

Mar 16, 2026 - 12:00 euvd

EUVD-2025-208717

Analysis Generated

Mar 16, 2026 - 12:00 vuln.today

CVE Published

Mar 16, 2026 - 11:54 nvd

MEDIUM 6.9

DescriptionCVE.org

Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges.

This issue was fixed in version 1.4.6.

AnalysisAI

Raytha CMS lacks brute force protection mechanisms, allowing attackers to conduct unlimited automated login attempts without triggering account lockout, rate limiting, or multi-factor authentication challenges. Versions prior to 1.4.6 are affected, and an attacker can systematically enumerate valid usernames and crack passwords through high-volume credential stuffing attacks. The vulnerability represents a significant authentication bypass risk that could lead to unauthorized administrative access depending on password strength and user enumeration feasibility.

Technical ContextAI

This vulnerability falls under CWE-307 (Improper Restriction of Rendered UI Layers or Frames), which encompasses authentication control weaknesses including the absence of brute force protections. Raytha CMS, a content management system, implements user authentication without implementing industry-standard defensive measures such as account lockout after failed attempts, exponential backoff delays, CAPTCHA challenges, or IP-based rate limiting. The root cause is insufficient input validation and state management in the authentication handler, allowing the application to process unlimited login requests in rapid succession without any throttling mechanism or consecutive failure tracking per user account or source IP.

RemediationAI

Upgrade Raytha CMS to version 1.4.6 or later immediately, as this version includes implemented brute force protection. Prior to patching, implement compensating controls: enforce account lockout policies at the application or reverse proxy level using tools like ModSecurity or Fail2ban to block IPs after five failed login attempts within a 15-minute window, enable MFA for all administrative accounts to reduce the impact of credential compromise, implement rate limiting at the reverse proxy level (e.g., 5 requests per minute per IP), and monitor authentication logs for suspicious patterns. If an on-premises deployment, restrict administrative access to known IP ranges via firewall rules and consider implementing a WAF with built-in brute force detection rules.