CVE-2025-42615
Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup
Description
In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the account to be locked or generating any specific alert for administrators. This lack of rate-limiting and lockout on OTP failures significantly lowers the cost of online brute-force attacks against 2FA codes and increases the risk of successful account takeover, especially if OTP entropy is reduced (e.g. short numeric codes, user reuse, or predictable tokens). Additionally, administrators had no direct visibility into accounts experiencing repeated 2FA failures, making targeted attacks harder to detect and investigate. The patch introduces a persistent failed_otp_attempts counter on user accounts, locks the user after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces an account lockout policy for OTP brute-force attempts and improves monitoring capabilities for suspicious 2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0.
INFO
Published Date :
Dec. 8, 2025, 12:16 p.m.
Last Modified :
Oct. 14, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Affected Products
The following products are affected by CVE-2025-42615
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 | ||||
| CVSS 4.0 | HIGH | a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 |
Solution
- Apply the vendor patch to update the software.
- Configure failed OTP attempt limits.
- Monitor for suspicious 2FA activity.
- Lock accounts after excessive invalid OTP attempts.
Public PoC/Exploit Available at Github
CVE-2025-42615 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-42615.
| URL | Resource |
|---|---|
| https://vulnerability.circl.lu/vuln/gcve-1-2025-0033 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-42615 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-42615
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Repo for discovered public vulnerabilities & corresponding CVEs
0day 0day-exploit cve exploit vulnerabilities zero-day-exploit
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-42615 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-42615 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: Vulnerability-Lookup de CIRCL, Description: En las versiones afectadas, vulnerability-lookup no rastreaba ni limitaba los intentos fallidos de Contraseña de Un Solo Uso (OTP) durante la verificación de Autenticación de Dos Factores (2FA). Un atacante que ya conocía o adivinó un nombre de usuario y una contraseña válidos podía enviar un número arbitrario de códigos OTP sin provocar el bloqueo de la cuenta ni generar ninguna alerta específica para los administradores. Esta falta de limitación de velocidad y bloqueo en los fallos de OTP reduce significativamente el coste de los ataques de fuerza bruta en línea contra códigos 2FA y aumenta el riesgo de una toma de control exitosa de la cuenta, especialmente si la entropía de OTP se reduce (p. ej., códigos numéricos cortos, reutilización por parte del usuario o tokens predecibles). Además, los administradores no tenían visibilidad directa sobre las cuentas que experimentaban fallos repetidos de 2FA, lo que hacía que los ataques dirigidos fueran más difíciles de detectar e investigar. El parche introduce un contador persistente de failed_otp_attempts en las cuentas de usuario, bloquea al usuario después de 5 envíos de OTP inválidos, restablece el contador tras una verificación exitosa y muestra los intentos fallidos de 2FA en la lista de usuarios administradores. Esto impone una política de bloqueo de cuenta para los intentos de fuerza bruta de OTP y mejora las capacidades de monitoreo para actividad sospechosa de 2FA. Este problema afecta a Vulnerability-Lookup: antes de 2.18.0. -
CVE Modified by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'CIRCL', 'product': 'Vulnerability-Lookup', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.18.0', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-42615', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-12-08T16:58:48.964002Z'} -
New CVE Received by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Dec. 08, 2025
Action Type Old Value New Value Added Description In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the account to be locked or generating any specific alert for administrators. This lack of rate-limiting and lockout on OTP failures significantly lowers the cost of online brute-force attacks against 2FA codes and increases the risk of successful account takeover, especially if OTP entropy is reduced (e.g. short numeric codes, user reuse, or predictable tokens). Additionally, administrators had no direct visibility into accounts experiencing repeated 2FA failures, making targeted attacks harder to detect and investigate. The patch introduces a persistent failed_otp_attempts counter on user accounts, locks the user after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces an account lockout policy for OTP brute-force attempts and improves monitoring capabilities for suspicious 2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-307 Added Reference https://vulnerability.circl.lu/vuln/gcve-1-2025-0033