EUVD-2026-66661
GHSA-63j3-2xmc-chxm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed DWSurvey instance
-
DeliverySend request to /api/dwsurvey/none/ or /api/dwsurvey/up/
-
ExploitBypass authentication filter
-
ExecutionInvoke protected API function
-
ImpactAccess data or upload file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability to a running DWSurvey v6.14.0 instance and requests directed at the specific vulnerable route prefixes '/api/dwsurvey/none/' or '/api/dwsurvey/up/**' - these paths themselves are the trigger, as they are exempted from authentication. Consistent with the CVSS vector (PR:N/UI:N/AC:L), no credentials, no user interaction, and no special non-default configuration are indicated. The main limiting factor is exposure: exploitation requires that the DWSurvey application (and these API paths) be network-accessible to the attacker, so instances restricted to internal networks or fronted by an authenticating proxy are not reachable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated attack with full CIA impact - a maximal-severity profile on paper. However, EPSS is only 0.18% (8th percentile), and the CVE is NOT in CISA KEV, so there is currently no signal of active or automated in-the-wild exploitation; the high CVSS reflects potential impact rather than observed attacks. The disconnect between a 9.8 base score and a low EPSS is best explained by the product's limited real-world footprint (niche open-source survey tool) rather than by any technical mitigating factor. No SSVC decision data was provided. A public writeup exists, which typically raises exploitation likelihood over time, so organizations actually running DWSurvey v6.14.0 should treat this as high priority; the broader ecosystem risk is constrained by low prevalence. CPE/version data is missing and should be verified against the vendor before scoping. |
| Exploit ScenarioDerived | An attacker who can reach the DWSurvey web server sends a crafted HTTP request to a path under '/api/dwsurvey/none/' or '/api/dwsurvey/up/**' and, because those routes bypass authentication, invokes protected API functionality (such as data access or file upload) without any credentials. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction; a public writeup detailing the affected endpoints lowers the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
RemediationAI
No vendor-released patch version is identified in the available data, so a specific fixed release cannot be cited - monitor the DWSurvey project (GitHub) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-75325) for an updated build beyond 6.14.0. As compensating controls, place the application behind a reverse proxy or WAF and block or require authentication on the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' URL paths (trade-off: may break legitimate anonymous survey submission or file-upload features that rely on those routes, so test which endpoints real users need); restrict network exposure of the DWSurvey admin/API surface to trusted networks or VPN; and review the application's URL-authorization configuration to remove or tighten the wildcard path exemptions. Review server logs for anonymous requests to the affected endpoints to detect prior abuse.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DWSurvey is an open-source online survey/questionnaire platform (Java/Spring-based). The root cause is CWE-287 (Improper Authentication): the application's URL authorization filter appears to whitelist path prefixes such as '/api/dwsurvey/none/' and the '/api/dwsurvey/up/**' wildcard as unauthenticated routes, so any request matching those patterns bypasses the login/session requirement. This is a classic broken-access-control-via-permissive-path-matching problem, where wildcard route exemptions unintentionally expose sensitive API operations (e.g., file upload via the 'up' path) to anonymous callers. CPE data is non-informative ('cpe:2.3:a:n/a:n/a:*') and does not enumerate the vendor or product, so exact affected components are inferred from the description alone.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable API paths that skip authentication give unauthenticated (PR:N), low-complexity access to protected functionality with high confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
Executive ViewAI
DWSurvey v6.14.0 contains a critical authentication bypass allowing unauthenticated remote attackers to reach protected API endpoints (/api/dwsurvey/none/ and /api/dwsurvey/up/**), with publicly available exploit code existing. This exposes survey data and administrative functionality to unauthorized access, creating immediate risk of data breach and unauthorized system modifications. Organizations running this version must implement emergency compensating controls immediately, as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Web Application Firewall rules blocking /api/dwsurvey/none/ and /api/dwsurvey/up/** paths; (2) Network access controls restricting endpoints to authorized internal networks only; (3) Reverse-proxy or API gateway requiring additional authentication before reaching DWSurvey; (4) Comprehensive request logging and monitoring with alerts for anomalous access patterns; (5) Disabling vulnerable endpoints if functionally non-critical to operations; (6) Vendor escalation for security roadmap and active evaluation of alternative survey platforms.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB