How severe is CVE-2025-26522?

CVE-2025-26522 has a CVSS 4.0 base score of 7.5, rated high severity.

Is CVE-2025-26522 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-26522?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-26522 have an EU (EUVD) identifier?

Yes. CVE-2025-26522 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4208.

When was CVE-2025-26522 published?

CVE-2025-26522 was published on 2025-02-14 and last updated on 2026-06-17.

CVE-2025-26522

CVE-2025-26522 is a high-severity vulnerability with a CVSS 4.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-302.

Key facts

Severity: High (CVSS 4.0 base score 7.5)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-4208
Weakness: CWE-302
Published: 2025-02-14
Last modified: 2026-06-17

Description

This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

Frequently asked questions

What is CVE-2025-26522?: This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
How severe is CVE-2025-26522?: CVE-2025-26522 has a CVSS 4.0 base score of 7.5, rated high severity.
Is CVE-2025-26522 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-26522?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-26522 have an EU (EUVD) identifier?: Yes. CVE-2025-26522 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4208.
When was CVE-2025-26522 published?: CVE-2025-26522 was published on 2025-02-14 and last updated on 2026-06-17.

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020

Other CWE-302 vulnerabilities

CVE-2026-48781 — Critical (CVSS 9.9): Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an…
CVE-2024-56404 — Critical (CVSS 9.9): In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows…
CVE-2024-43441 — Critical (CVSS 9.8): Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache…
CVE-2025-47158 — Critical (CVSS 9.0): Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges…
CVE-2024-12838 — High (CVSS 8.8): The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass…
CVE-2026-39429 — High (CVSS 8.2): kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior…

Browse all CWE-302 vulnerabilities →