VULNERABILITY INTELLIGENCE
CVE-2025-54955
CVSS score8.1 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2025-08-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.
Weakness classification
- cve@mitre.org: CWE-362