CVE-2025-55299 - CVE House
Back to Database
Status published Critical CVE-2025-55299

VaulTLS has a password-based login exploit in additional user accounts

Vulnerability Description

VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the password based login only effected the frontend, but still allowed login via the API. This vulnerability is fixed in 0.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55299

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

VaulTLS
Vulnerable Versions:
< 0.9.1

Timeline

Official Publish: August 18th, 2025
Last Modified: August 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-521

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.