CVE-2025-12868
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Nov 10, 2025
CISA due date
—
The record
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-76945 The affected Ebyte device relies on client-managed authentication tokens without… CWE-603
- CVE-2026-71187 The Ebyte device relies on client side authentication logic that can be reproduced by… CWE-603
- CVE-2026-42098 Sparx Enterprise Architect software has a security feature that limits user's actions to… CWE-603
- CVE-2026-8830 A flaw was found in Keycloak. CWE-603
- CVE-2026-40551 mpGabinet performs client-side authentication. CWE-603
- CVE-2025-30042 The CGM CLININET system provides smart card authentication; however, authentication is… CWE-603
- CVE-2026-1363 IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security… CWE-603
- CVE-2025-64119 A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This… CWE-603