Weak Password Requirements in Apache Fineract by Apache Software Foundation
CVE-2025-23408

8.5HIGH

Key Information:

Vendor

Apache
Status
Apache Fineract
Vendor
CVE Published:
12 December 2025

What is CVE-2025-23408?

The weak password requirements in Apache Fineract allow for insufficient protection against unauthorized access, potentially jeopardizing sensitive financial data. This vulnerability is present in versions of the software up to 1.10.1. Users are strongly advised to upgrade to version 1.11.0 or later to enhance their security posture and mitigate the risk associated with weak password configurations.

Affected Version(s)

Apache Fineract 0 <= 1.10.1

Apache Fineract 1.11.0

References

https://lists.apache.org/thread/bdlb6wl968yh1n48mr5npsk2s...
vendor-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Chen, PayPal Security
Kristof Jozsa, BaaSFlow
JSON
.
CVE-2025-23408 : Weak Password Requirements in Apache Fineract by Apache Software Foundation