CVE-2025-26341
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.1%
exploitation probability
1.1%top 38% of all CVEs
observed exploitation
nono source reports it
In short
An attacker can reset any user's password without logging in to Q-Free MaxTime software. This lets them take over accounts and steal sensitive information.
Technical detail
CWE-306 missing authentication vulnerability in maxprofile/accounts/routes.lua allows unauthenticated remote attackers to reset arbitrary user passwords through crafted HTTP requests. The critical function lacks proper access controls, enabling account takeover without valid credentials or pre-authentication.
Summary generated and translated by AI from the official description.
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Q-Free · MaxTime