CVE-2025-13315

Critical · 9.8

CVSS

9.8

EPSS

31.2%

Published

Nov 19, 2025

CISA due date

—

The record

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

Affected packages

Ecosystem	Package	Introduced	Fixed