CVE-2025-40807

Medium · 5.4

CVSS

5.4

EPSS

0.3%

Published

Dec 9, 2025

CISA due date

—

The record

A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.

Affected packages

Ecosystem	Package	Introduced	Fixed