Authentication Bypass Vulnerability in Internal Service Endpoints of a Major Vendor's Application

CVE-2025-30037

What is CVE-2025-30037?

A vulnerability has been identified in a major vendor's application server, where several internal service endpoints are inadvertently exposed to the public. These endpoints, often found in paths containing '/int/', are accessible without any form of authentication. This misconfiguration allows unauthorized users to interact with internal functions that should be restricted, posing significant security risks. Organizations using affected versions of the application server should prioritize remediation to protect against unauthorized access.

References