Token-Based Authentication Flaw in Rallly Scheduling Tool

CVE-2025-47781

What is CVE-2025-47781?

Rallly, an open-source scheduling and collaboration tool, has a vulnerability in its token-based authentication mechanism. Versions up to and including 3.22.1 allow an attacker to exploit weak entropy in a 6-digit token used for user account verification. Given the absence of brute force protection, an attacker who knows a valid email address can attempt to guess the token within a 15-minute window, potentially gaining unauthorized access to user accounts. To enhance security, it is necessary to implement tokens with higher entropy and include rate limiting on the authentication endpoint.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References