Back to Database
Status published
Critical
CVE-2025-26341
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in...
Vulnerability Description
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-26341
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Andrea Palanca of Nozomi Networks found this bug during a security research activity.
- Q-Free
More from Q-Free
View All →CVE-2025-26378
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
High
8.8
CVE-2025-26377
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
High
8.1
CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
Medium
6.5
CVE-2025-26375
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
High
8.8
CVE-2025-26374
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free...
Medium
6.5
Affected Vendor
Q-Free
View all reports →Affected Software
MaxTime
Vulnerable Versions:
0
Timeline
Official Publish:
February 12th, 2025
Last Modified:
February 17th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H