CVE-2025-71455

CVSS 5.9 (medium) · published 2026-11-04

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

Weakness: CWE-200

Source: NVD CVE-2025-71455

References

• https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/
• https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/
• https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note
• https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.