What is the CVSS score of CVE-2026-25519?

CVE-2026-25519 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openslides are affected by CVE-2026-25519?

OpenSlides versions prior to 4.2.29 contain a HIGH severity authentication vulnerability (CVE-2026-25519, CVSS 8.1) that could allow unauthorized access to assembly management systems.. A patch is available.

How to fix or mitigate CVE-2026-25519?

Within 24 hours: Identify all OpenSlides instances in your environment and verify current version numbers. Within 7 days: Apply vendor patch 4.2.29 or later to all production and non-production instances; test in staging environment first. Within 30 days: Conduct access log review for indicators of exploitation and reset credentials for all administrative accounts as a precaution.

Openslides CVE-2026-25519

HIGH

Improper Access Control (CWE-284)

2026-02-04 security-advisories@github.com

Authentication Bypass Openslides

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 18, 2026 - 20:56 nvd

Patch available

CVE Published

Feb 04, 2026 - 21:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenSlides username of a SAML user and a trivial password. This password is valid for all SAML users. This issue has been patched in version 4.2.29.

AnalysisAI

OpenSlides versions prior to 4.2.29 allow unauthorized authentication bypass for SAML-synchronized users through the local login form by using the victim's username with a hardcoded trivial password. An attacker can gain complete access to any SAML user account without knowing their actual credentials, potentially compromising sensitive assembly management data including agendas, motions, and election information. A patch is available in version 4.2.29 and should be applied immediately to all affected instances.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Openslides. OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenS