CVE-2025-32898 MEDIUM

CVE-2025-32898

Vendor Kde
Product KDE Connect verification-code protocol
Weakness CWE-331
Published December 5, 2025
Last update December 5, 2025
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Key dates

02Disclosure timeline

December 5, 2025 CVE published
December 5, 2025 Record updated