Bypass Vulnerability in GTT Tax Information System by GTT

CVE-2025-13953

What is CVE-2025-13953?

A critical bypass vulnerability exists in the authentication method of the GTT Tax Information System, specifically concerning Active Directory (LDAP) login. The application utilizes a local WebSocket for authentication; however, it fails to adequately validate the authenticity or origin of incoming data. This flaw enables attackers with access to the internal network or local machine to impersonate legitimate WebSocket connections, facilitating the injection of manipulated data. Exploiting this vulnerability grants unauthorized authentication, permitting attackers to masquerade as any user in the domain without needing valid credentials, thus threatening the overall confidentiality, integrity, and availability of sensitive information within the application.

References