1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43863

CVE-2025-43863: vantage6 lacks brute-force protection on change password functionality

Impact

If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct

Patches

This issue has been patched in version 4.11.0

Workarounds

None

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43863

CVE-2025-43863:

1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vantage6	pip	< 4.11.0	4.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the password change functionality, specifically in how the old password was verified. The provided commit e0f1841b310f6f610e8137db2506cf683ce154d0 shows changes in vantage6-server/vantage6/server/resource/recover.py.

The key change is within the Password class, in its patch method. Before the patch, the code was:

        # check if the old password is correct
        pw_correct = user.check_password(old_password)
        if not pw_correct:
            return {
                "msg": "Your current password is not correct!"
            }, HTTPStatus.UNAUTHORIZED

This direct check user.check_password(old_password) lacked any mechanism to prevent repeated attempts, thus allowing a brute-force attack on the current password if an attacker had an active session.

The patch replaced this with:

        user_or_error, code = user_login(
            self.config, user.username, old_password, self.mail
        )
        if code != HTTPStatus.OK:
            return user_or_error, code

The user_login function, which is also used for regular logins, is expected to have brute-force protection (e.g., account lockout, rate limiting). By routing the current password verification through user_login, the password change functionality now benefits from these protections.

Therefore, the patch method of the Password class (fully qualified name vantage6.server.resource.recover.Password.patch) was the vulnerable function as it processed the password change request and, prior to the patch, allowed an unlimited number of attempts to verify the old password.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

1.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-43863: vantage6 lacks brute-force protection on change password functionality

Impact

Patches

Workarounds

CVE-2025-43863:

1.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2025-43863: vantage6 lacks brute-force protection on change password functionality

Impact

Patches

Workarounds

1.7

1.7

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI