Vulnerability in SOPlanning's Password Recovery Mechanism
CVE-2025-62294

8.7HIGH

Key Information:

Vendor

Soplanning

Status
Soplanning
Vendor
CVE Published:
20 November 2025

What is CVE-2025-62294?

SOPlanning is affected by a vulnerability that arises from the predictable generation of recovery tokens, allowing attackers to brute-force token values. This weakness enables unauthorized access to user accounts, posing significant security risks. The flaw has been addressed in version 1.55, which enhances the token generation mechanism to ensure that it is less susceptible to exploitation.

Affected Version(s)

SOPlanning 0 < 1.55

References

https://cert.pl/en/posts/2025/11/CVE-2025-62293
third-party-advisory
https://www.soplanning.org/en/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ɓukasz Jaworski (Pentest Limited)
JSON
.
CVE-2025-62294 : Vulnerability in SOPlanning's Password Recovery Mechanism