EUVD-2025-201386
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4Description
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Analysis
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Technical Context
An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Authentication Bypass by Spoofing (CWE-290).
Affected Products
Affected: KDE Connect
Remediation
Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | released | 25.11.80+git20251121.7090b106-1 |
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| plucky | not-affected | code not present |
| xenial | not-affected | code not present |
| questing | released | 25.08.1-0ubuntu2.1 |
| Release | Status | Version |
|---|---|---|
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| questing | needed | - |
| upstream | released | 70 |
| plucky | ignored | end of life, was needed |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | not-affected | - | - |
| trixie (security), trixie | fixed | 62-1+deb13u1 | - |
| forky, sid | fixed | 71-1 | - |
| trixie | fixed | 62-1+deb13u1 | - |
| (unstable) | fixed | 71-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | not-affected | - | - |
| bookworm | not-affected | - | - |
| trixie (security), trixie | fixed | 25.04.2-1+deb13u1 | - |
| forky, sid | fixed | 25.11.80+git20251121.7090b106-1 | - |
| trixie | fixed | 25.04.2-1+deb13u1 | - |
| (unstable) | fixed | 25.11.80+git20251121.7090b106-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today