CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-25182

Trust Issues: Stroom Auth Bypass & SSRF via AWS ALB Spoofing

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·47 visits

Executive Summary (TL;DR)

Stroom trusted the 'signer' field in AWS ALB headers without verification. Attackers can bring their own ALB signatures to log in as anyone, or inject malicious regions into the signer ARN to trigger SSRF against the AWS Metadata Service (IMDS).

A critical authentication bypass and SSRF vulnerability in GCHQ's Stroom data platform allows attackers to spoof AWS Application Load Balancer identities or reach internal AWS metadata services.

Official Patches

GCHQPull Request #4320 fixing the vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score
9.4/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Probability
0.33%
Top 45% most exploited

Affected Systems

Stroom Data Platform (GCHQ)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Stroom
GCHQ
>= 7.2-beta.53, < 7.2.247.2.24
Stroom
GCHQ
7.3-beta.1 - < 7.3-beta.227.3-beta.22
Stroom
GCHQ
7.4-beta.1 - < 7.4.47.4.4
Stroom
GCHQ
7.5-beta.17.5-beta.2
AttributeDetail
CWECWE-290 (Auth Bypass by Spoofing)
CVSS9.4 (Critical)
Attack VectorNetwork
Exploit StatusPoC Available
ImpactAuthentication Bypass / SSRF
KEV StatusNot Listed

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1553Subvert Trust Controls
Defense Evasion
T1078Valid Accounts
Persistence
CWE-290
Authentication Bypass by Spoofing

Authentication Bypass by Spoofing

Known Exploits & Detection

Miggo SecurityOriginal research and discovery details
NucleiDetection Template Available

Vulnerability Timeline

Fix Committed to GitHub
2024-06-05
Public Disclosure & CVE Published
2025-02-12

References & Sources

  • [1]GHSA Advisory
  • [2]AWS ALB OIDC Documentation

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 5 hours ago•CVE-2026-57576
6.5

CVE-2026-57576: Application-Level Denial of Service via Uncontrolled Resource Consumption in Plone

CVE-2026-57576 is an application-level Denial of Service (DoS) vulnerability in Plone. It resides in the `plone.app.dexterity` and `plone.app.contenttypes` packages, allowing authenticated users with content creation permissions to submit excessively long metadata attributes. Because these fields are stored without length limits and subsequently processed by indexing and rendering engines, they trigger complete server resource exhaustion and thread starvation.

Alon Barad
Alon Barad
6 views•9 min read
•about 6 hours ago•GHSA-8PCW-H6W9-H46G
6.5

GHSA-8PCW-H6W9-H46G: Denial of Service via Uncontrolled Resource Consumption in plone.app.contenttypes

An uncontrolled resource consumption vulnerability in plone.app.contenttypes allows authenticated users to trigger application-level denial of service via oversized filename metadata in file uploads.

Amit Schendel
Amit Schendel
7 views•6 min read
•about 7 hours ago•CVE-2026-61685
7.5

CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress

An unauthenticated remote SQL injection vulnerability exists in multiple API list endpoints of ReactPress prior to version 3.7.0. The vulnerability stems from unsafe construction of TypeORM QueryBuilder conditions, where untrusted HTTP query parameter keys are interpolated directly into SQL statements as identifiers without sanitization or validation.

Alon Barad
Alon Barad
7 views•9 min read
•about 8 hours ago•CVE-2026-56669
7.5

CVE-2026-56669: Remote Denial of Service via Algorithmic Complexity and Interpretation Conflict in Elysia

CVE-2026-56669 is a high-severity vulnerability in the Elysia web framework (ElysiaJS) that combines Inefficient Algorithmic Complexity (CWE-407) and an Interpretation Conflict (CWE-436). It allows remote, unauthenticated attackers to cause a complete Denial of Service (DoS) via CPU resource exhaustion using specially crafted multipart or urlencoded payloads.

Amit Schendel
Amit Schendel
8 views•6 min read
•about 9 hours ago•CVE-2026-86065
7.5

CVE-2026-86065: Denial of Service via Resource Exhaustion in klever-go WebSocket Subscription Endpoint

Prior to version 1.7.20, the default-open WebSocket `/subscribe` endpoint in klever-go was vulnerable to remote resource exhaustion. Unauthenticated, remote attackers could crash validator and node processes by exploiting unbounded frame reads, uncapped concurrent connections, unrestricted memory allocation for subscription address keys, and a permanent memory leak in subscription map tracking on client disconnects.

Alon Barad
Alon Barad
7 views•7 min read
•about 10 hours ago•CVE-2026-82405
8.7

CVE-2026-82405: Incorrect Authorization leading to Account Takeover in klever-go

A critical incorrect authorization vulnerability (CWE-863) exists in the Go implementation of the Klever blockchain protocol (klever-go) prior to version 1.7.20. The vulnerability allows an attacker to completely replace a target account's permission set by manipulating the RecipientAddr parameter in a VM built-in function, leading to total account takeover.

Amit Schendel
Amit Schendel
8 views•5 min read