CVE-2025-71454
EUVD-2025-21125204.11.2026, 21:17
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| vtenext | vtenext | 𝑥 < 25.2.2 | CNA |
Common Weakness Enumeration
References