What’s Vulnerable › Vulnerabilities

CVE-2025-55796

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-18 · updated 2026-09-29
• Weakness: CWE-400

Description

The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover.

Affected products

• Openml Frontend: before 2.0.20251111 — fixed in 2.0.20251111

How to fix

Upgrade to a fixed version: Openml Frontend 2.0.20251111. Check the vendor advisory for mitigations.

References

• https://github.com/openml
• https://github.com/openml/openml.org
• https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6

Get alerted when CVE-2025-55796 or the next vulnerability affects your stack