What’s Vulnerable › Vulnerabilities

CVE-2025-58156: Centurion ERP users can view hashed authentication tokens that belong to other users

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-29 · updated 2026-10-18
• Weakness: CWE-285

Description

Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database.

Affected products

• nofusscomputing centurion_erp: from 1.12.0 before 1.21.0 — fixed in 1.21.0

How to fix

Upgrade to a fixed version: nofusscomputing centurion_erp 1.21.0. Check the vendor advisory for mitigations.

References

• https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34
• https://github.com/nofusscomputing/centurion_erp/pull/974
• https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg

Get alerted when CVE-2025-58156 or the next vulnerability affects your stack