CVE-2025-62294 HIGH

CVE-2025-62294: Predictable Generation of Password Recovery Token

Vendor Soplanning
Product SOPlanning
Weakness CWE-340
Published November 20, 2025
Last update November 20, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55.

Key dates

02Disclosure timeline

November 20, 2025 CVE published
November 20, 2025 Record updated