CVE-2025-1107: Unverified password change vulnerability in Janto

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-07 · updated 2026-06-17
Weakness: CWE-620

Description

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.

Affected products

Impronta Janto: before r12 — fixed in r12

How to fix

Upgrade to a fixed version: Impronta Janto r12. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto

Get alerted when CVE-2025-1107 or the next vulnerability affects your stack