Improper Authentication in pwn.college DOJO Education Platform

CVE-2025-62376

What is CVE-2025-62376?

The pwn.college DOJO platform has a vulnerability in its /workspace endpoint that allows unauthorized access to active Windows VMs. This flaw arises from the view_desktop function, which inadequately verifies user authorization. An attacker can exploit this by providing a user ID and an arbitrary password, thereby impersonating other users. This compromises the confidentiality and integrity of all data on affected Windows machines and the Linux home directories, as attackers can manipulate these resources freely. The vulnerability has been addressed in the latest commit, and no workarounds are available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References