A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Getmaxun
  • Maxun

No data.

No data.

References
Link Providers
https://gist.github.com/H2u8s/40be31987e52fc81076b6bfcfbdf3cd6 cve-icon cve-icon
https://vuldb.com/?ctiid.338476 cve-icon cve-icon
https://vuldb.com/?id.338476 cve-icon cve-icon
https://vuldb.com/?submit.710256 cve-icon cve-icon
History

Mon, 29 Dec 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Getmaxun
Getmaxun maxun
Vendors & Products Getmaxun
Getmaxun maxun

Mon, 29 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 27 Dec 2025 09:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Title getmaxun auth.ts hard-coded key
Weaknesses CWE-320
CWE-321
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-12-27T09:02:06.124Z

Updated: 2025-12-29T15:55:05.915Z

Reserved: 2025-12-26T18:10:50.723Z

Link: CVE-2025-15105

cve-icon Vulnrichment

Updated: 2025-12-29T15:55:01.065Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-27T09:15:40.220

Modified: 2025-12-29T15:57:37.560

Link: CVE-2025-15105

cve-icon Redhat

No data.