CVE-2025-71457 is a critical authentication bypass in vtenext 25.02 before 25.02.1. An unauthenticated attacker can change any account's password through hub/rpwd.php, because the endpoint never checks a token.
What Is It
The flaw is in vtenext's password recovery flow. The hub/rpwd.php endpoint accepts a password change request without checking a recovery token. An attacker who knows a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and set a new password for that account. The weakness is classified as CWE-620 (Unverified Password Change).
VulnCheck disclosed the issue. NVD published the record on 2026-11-04, and its status is currently "Received."
Why It Matters
The attack runs over the network, is low complexity, and needs no privileges or user interaction. The attacker only needs a valid username. With that, they can take over accounts, including administrator accounts that don't have two-factor authentication. A successful takeover gives the attacker the access of whichever account they reset.
Severity ratings from VulnCheck:
- CVSS 3.1: 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 4.0: 9.3 CRITICAL
Exploitation status: As of 2026-11-04, CVE-2025-71457 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. Because the CVE is not in KEV, CISA has set no required action or due date for it.
What's Vulnerable
- Vendor: vtenext
- Product: vtenext
- Affected versions: 25.02 up to but not including 25.02.1
Versions outside this range are listed as unaffected by default. The NVD record does not list any affected CPEs yet.
Patch Status
The issue is fixed in vtenext 25.02.1, and the vendor has published release notes for that version (linked below). Organizations running vtenext 25.02 should upgrade to 25.02.1. Accounts without two-factor authentication are the ones exposed to takeover, so check whether 2FA is turned on for administrator accounts.