Authentication Bypass in Q-Free MaxTime Product
CVE-2025-26364

7.5HIGH

Key Information:

Vendor

Q-free

Status
Maxtime
Vendor
CVE Published:
12 February 2025

What is CVE-2025-26364?

The Q-Free MaxTime product has a vulnerability that permits unauthorized users to disable the authentication profile server through specially crafted HTTP requests. This flaw arises from improper implementation of authentication mechanisms. It highlights a significant risk, as it can be exploited by remote attackers without any authentication requirements, leading to potential unauthorized access and control over critical server functions.

Affected Version(s)

MaxTime 0 <= 2.11.0

References

https://www.nozominetworks.com/labs/vulnerability-advisor...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego Giubertoni of Nozomi Networks found this bug during a security research activity.
.