Security Flaw in getmaxun Affects Authentication Mechanism
CVE-2025-15105

6.3MEDIUM

Key Information:

Vendor: Getmaxun
Status: Maxun
Vendor: CVE Published:; 27 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15105?

A security flaw has been identified in the getmaxun product, particularly within the authentication endpoint located in the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. The issue is triggered by manipulation of the 'api_key' argument, leading to the use of a hard-coded cryptographic key. This vulnerability allows for potential remote exploitation, although the complexity of the attack is high, making it challenging to execute. Despite the vendor being informed of the issue, there has been no response, and the exploit has since been made public, raising concerns over potential attacks.

Affected Version(s)

maxun 0.0.1

maxun 0.0.2

maxun 0.0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15105 - Proof of Concept