CVE-2025-48925
Prioritize patching. It exploitation observed by VulnCheck.
TeleMessage's SGNL app performs password hashing on your device before sending it to authenticate, but the service accepts this client-side hash as the final credential instead of verifying it server-side. This means an attacker who intercepts the hash can reuse it to log in without knowing your actual password.
TeleMessage relies on client-side MD5 hashing for authentication, accepting the resulting hash as a credential without server-side verification (CWE-836: Use of a Broken or Risky Cryptographic Algorithm). An attacker can intercept the hash over the network or extract it from a compromised client and replay it for unauthorized authentication, bypassing the need to crack the original password.