CVE-2025-66377

High · 7.5

CVSS

7.5

EPSS

0.2%

Published

Dec 25, 2025

CISA due date

—

The record

Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes within the installation.

Affected packages

Ecosystem	Package	Introduced	Fixed