CVE-2025-9342: IDOR in Anadolu Hayat Emeklilik's AHE Mobile

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-23 · updated 2026-10-11
Weakness: CWE-639

Description

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9.

Affected products

Anadolu Hayat Emeklilik Inc. AHE Mobile: from 1.9.7 before 1.9.9 — fixed in 1.9.9

How to fix

Upgrade to a fixed version: Anadolu Hayat Emeklilik Inc. AHE Mobile 1.9.9. Check the vendor advisory for mitigations.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0287
https://www.usom.gov.tr/bildirim/tr-25-0287

Get alerted when CVE-2025-9342 or the next vulnerability affects your stack