Improper Input Validation in ServiceStack Affects User Credentials

CVE-2025-6444

What is CVE-2025-6444?

A vulnerability exists within the ServiceStack framework that allows remote attackers to relay NTLM credentials through a flaw in the GetErrorResponse method. This issue arises from insufficient validation of user-provided data, leading to a potential type confusion. Attackers can exploit this flaw to compromise user credentials, putting sensitive information at risk. Immediate action is recommended to mitigate this vulnerability by patching affected installations.

References