What’s Vulnerable › Vulnerabilities

CVE-2025-41086: Authorization bypass in GAMS from GAMS Development Corp.

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-02 · updated 2026-10-18
• Weakness: CWE-639

Description

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.

Affected products

• AMS Development Corp. GAMS: before 48.7.0; from 49.1.0 before 49.7.0 — fixed in 48.7.0, 49.7.0

How to fix

Upgrade to a fixed version: AMS Development Corp. GAMS 48.7.0, 49.7.0. Check the vendor advisory for mitigations.

References

• https://www.gams.com/latest/docs/RN_51.html
• https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-development-corp

Get alerted when CVE-2025-41086 or the next vulnerability affects your stack