CVE-2025-55278
High · 8.1CVSS
8.1
EPSS
0.2%
Published
Nov 5, 2025
CISA due date
—
The record
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
- CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
- CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102268 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102266 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-73784 A potential security vulnerability in HPE IceWall products could be exploited to tamper… CWE-347