Authentication Bypass Vulnerability in Q-Free MaxTime by Q-Free
CVE-2025-26366

7.5HIGH

Key Information:

Vendor

Q-free

Status
Maxtime
Vendor
CVE Published:
12 February 2025

What is CVE-2025-26366?

A vulnerability exists in Q-Free MaxTime due to missing authentication for critical functions in the setup routes, allowing unauthenticated remote attackers to disable front panel authentication through specially crafted HTTP requests. This oversight exposes the system to unauthorized access and potential manipulation of sensitive configurations.

Affected Version(s)

MaxTime 0 <= 2.11.0

References

https://www.nozominetworks.com/labs/vulnerability-advisor...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego Giubertoni of Nozomi Networks found this bug during a security research activity.
.