CVE-2025-32788 - CVE House

Back to Database

Status published Medium CVE-2025-32788

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

4.3 CVSS

Vulnerability Description

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32788

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OctoPrint

View All →

OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

OctoPrint Vulnerable to Denial of Service through malformed HTTP request

OctoPrint vulnerable to possible file extraction via upload endpoints

API key access in settings without reauthentication in OctoPrint

Affected Vendor

OctoPrint

View all reports →

Affected Software

OctoPrint

Vulnerable Versions:

< 1.11.0

Timeline

Official Publish: April 22nd, 2025

Last Modified: April 25th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1190 Exploit Public-Facing Application