9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-45616

CVE-2025-45616: BRCC Incorrect Access Control vulnerability

Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-45616

CVE-2025-45616:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.baidu.mapp:brcc-core	maven	<= 1.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the detailed information provided in the GitHub issue #194 for baidu/brcc. The issue explicitly names the vulnerable class (com.baidu.brcc.config.UserAuthFilter) and the primary affected method (doFilter). It also describes the flawed logic involving the request.getRequestURI() method and a helper method (referred to as noAuth in the description and confirmed by a code snippet image) that uses a startsWith check for URI patterns that do not require authentication. This combination allows an attacker to bypass authentication for admin APIs if a contextPath is configured and also included in the noAuths list. No commit information or patches were available, so the analysis relies entirely on the issue description, which is specific and includes code snippets from the issue's images/text that describe the vulnerable code sections. The parameters for doFilter are standard for a Java Servlet Filter. The parameters for noAuth are inferred from its usage (checking a URI against a list of patterns).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.