CVE-2025-26522 HIGH

CVE-2025-26522: Authentication Bypass Vulnerability in RupeeWeb trading platform

Vendor Rupeeseed Technology Ventures
Product RupeeWeb
Weakness CWE-302
Published February 14, 2025
Last update February 14, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

Key dates

02Disclosure timeline

February 14, 2025 CVE published
February 14, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-20285 Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability CVE-2016-9482 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass CVE-2024-56404 CVE-2026-34460 NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data