CVE-2025-26366 HIGH

CVE-2025-26366

Vendor Q-Free

Product MaxTime

Weakness CWE-306 · Missing auth

Published February 12, 2025

Last update February 17, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.

Key dates

02Disclosure timeline

February 12, 2025 CVE published

February 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-26366 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2024-45355 Xiaomi phone framework has unauthorized access vulnerability CVE-2026-28458 OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint CVE-2025-30040 Missing authentication in API returning request logs containing session IDs CVE-2025-15026 Unauthenticated configuration import allows administrative account creation using AWIE component CVE-2023-4815 Missing Authentication for Critical Function in answerdev/answer