CVE-2023-25524
CVE-2023-25524 is a medium-severity vulnerability in Nvidia Omniverse Launcher with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-598.
Key facts
- Severity: Medium (CVSS 3.x base score 4.0)
- EPSS exploit prediction: 0% (24th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-598
- Affected product: Nvidia Omniverse Launcher
- Published:
- Last modified:
Description
NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure.
Frequently asked questions
- What is CVE-2023-25524?
- NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure.
- How severe is CVE-2023-25524?
- CVE-2023-25524 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2023-25524 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-25524?
- CVE-2023-25524 primarily affects Nvidia Omniverse Launcher. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-25524?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-25524 published?
- CVE-2023-25524 was published on 2023-08-03 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:a:nvidia:omniverse_launcher:*:*:*:*:*:linux:*:*
- cpe:2.3:a:nvidia:omniverse_launcher:*:*:*:*:*:windows:*:*
More vulnerabilities in Nvidia Omniverse Launcher
- CVE-2022-21817 — Critical (CVSS 9.3): NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged…
All CVEs affecting Nvidia Omniverse Launcher →
Other CWE-598 vulnerabilities
- CVE-2025-69270 — Critical (CVSS 9.8): Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows,…
- CVE-2023-6014 — Critical (CVSS 9.8): An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
- CVE-2025-56551 — High (CVSS 8.2): An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate…
- CVE-2021-21594 — High (CVSS 8.2): Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings…
- CVE-2026-23846 — High (CVSS 8.1): Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password…
- CVE-2019-6531 — High (CVSS 8.1): An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to…