CVE-2025-42601 HIGH

CVE-2025-42601: Captcha Bypass Vulnerability in Meon KYC solutions

Vendor Meon

Product KYC solutions

Weakness CWE-602 · Client-side enforcement

Published April 23, 2025

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification mechanism.

Key dates

02Disclosure timeline

April 23, 2025 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-42601 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/602.html

Related vulnerabilities

04Related CVE

CVE-2025-12115 WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration CVE-2023-39218 CVE-2023-20171 Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities CVE-2026-25737 Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) CVE-2026-42160 Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend