Session Identifier Disclosure Vulnerability in vtenext by SicuraNext
CVE-2025-71455

5.9MEDIUM

Key Information:

Vendor

Vtenext

Status
Vtenext
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2025-71455?

The vtenext application, prior to version 25.02.2, is susceptible to a session identifier disclosure vulnerability. This issue arises when the PHPSESSID value can be exposed through the Touch web service endpoint. Attackers with the ability to execute scripts within the vtenext origin, potentially through cross-site scripting (XSS) attacks, can circumvent the HttpOnly flag, enabling them to hijack authenticated user sessions. This vulnerability can lead to unauthorized access and a breach of sensitive information, necessitating immediate attention and remediation.

Affected Version(s)

vtenext 0 < 25.02.2

References

https://blog.sicuranext.com/vtenext-25-02-a-three-way-pat...
third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to...
technical-description
https://usermanual.vtenext.com/books/release-notes-histor...
release-notes

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mattia "0xbro" Brollo
.