Account Takeover Vulnerability in Lunary AI by Lunary
CVE-2025-9803

9.3CRITICAL

Key Information:

Vendor

Lunary-ai

Status
Lunary-ai/lunary
Vendor
CVE Published:
25 November 2025

What is CVE-2025-9803?

Lunary AI version 1.9.34 is susceptible to account takeover attacks due to a flaw in its Google OAuth integration. The application improperly verifies the 'aud' (audience) field in access tokens issued by Google, which is essential for ensuring the token is valid for the intended application. This vulnerability allows attackers to exploit tokens that are intended for malicious applications, granting them unauthorized access to user accounts. This issue has been addressed in version 1.9.35.

Affected Version(s)

lunary-ai/lunary < 1.9.35

References

https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a5451...
https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5...

CVSS V3.0

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.