CTFd EUVD-2025-210783

Exploitation requires the attacker to be on the same adjacent Layer-2 network segment as the CTFd server or its active users - ruling out all remote internet-based attack vectors. No authentication to CTFd is required by the attacker. The vulnerability is most acutely exposed in live CTF competition environments where participants and platform administrators share the same local area network or wireless access point, creating an adversarial adjacency scenario by design. Limiting factors: the AV:A constraint confines the attacker pool to those with physical or logical access to the same LAN/WLAN; availability is not impacted (A:N); integrity impact is limited (I:L), indicating full bidirectional traffic tampering may not be achievable. No non-default configuration setting or specific CTFd feature flag is identified as a prerequisite - the vulnerability appears to affect the platform's general communication handling in v3.7.6.

The CVSS base score of 7.1 (High) is driven by high confidentiality impact and the absence of authentication or user-interaction requirements, but the adjacent-network attack vector (AV:A) is the critical limiting factor - remote internet-based exploitation is not possible. An attacker must have physical or logical presence on the same Layer-2 network segment as the target, substantially narrowing the realistic threat pool. The EPSS score of 0.15% at the 4th percentile strongly corroborates that this is not being actively exploited at scale. No public exploit code has been identified and no CISA KEV listing exists. The real-world risk is highest specifically during live CTF events, where competitors - who are by nature security-literate - share a network with the platform they are competing on, creating an adversarial adjacency scenario that is atypical for most enterprise software. Outside of event contexts, risk is substantially lower. No conflicting data signals were detected, but the specific technical mechanism (e.g., plaintext HTTP, weak TLS validation) is not confirmed from available references.

An attacker sharing a Wi-Fi access point or LAN with CTFd users - such as a competition participant at a live CTF event - executes an ARP spoofing attack using standard tooling (e.g., Bettercap) to position themselves as the network gateway. Unencrypted or inadequately protected HTTP traffic between CTFd clients and the server then flows through the attacker's device, allowing passive capture of session cookies, credentials, or flag submissions. No public exploit code has been identified at time of analysis, but the attack requires only commodity MITM tooling and network adjacency.