CVE-2025-66270

4.7MEDIUM

Key Information:

Vendor

Kde

Status
Kde Connect Protocol
Vendor
CVE Published:
5 December 2025

What is CVE-2025-66270?

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

Affected Version(s)

KDE Connect protocol 8

References

https://invent.kde.org/network/kdeconnect-kde/-/commit/4e...
https://invent.kde.org/network/kdeconnect-android/-/commi...
https://invent.kde.org/network/kdeconnect-ios/-/commit/6c...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66270 : KDE Connect Protocol Vulnerability in Multiple Platforms