CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-25182

Trust Issues: Stroom Auth Bypass & SSRF via AWS ALB Spoofing

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·43 visits

Executive Summary (TL;DR)

Stroom trusted the 'signer' field in AWS ALB headers without verification. Attackers can bring their own ALB signatures to log in as anyone, or inject malicious regions into the signer ARN to trigger SSRF against the AWS Metadata Service (IMDS).

A critical authentication bypass and SSRF vulnerability in GCHQ's Stroom data platform allows attackers to spoof AWS Application Load Balancer identities or reach internal AWS metadata services.

Official Patches

GCHQPull Request #4320 fixing the vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score
9.4/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Probability
0.33%
Top 45% most exploited

Affected Systems

Stroom Data Platform (GCHQ)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Stroom
GCHQ
>= 7.2-beta.53, < 7.2.247.2.24
Stroom
GCHQ
7.3-beta.1 - < 7.3-beta.227.3-beta.22
Stroom
GCHQ
7.4-beta.1 - < 7.4.47.4.4
Stroom
GCHQ
7.5-beta.17.5-beta.2
AttributeDetail
CWECWE-290 (Auth Bypass by Spoofing)
CVSS9.4 (Critical)
Attack VectorNetwork
Exploit StatusPoC Available
ImpactAuthentication Bypass / SSRF
KEV StatusNot Listed

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1553Subvert Trust Controls
Defense Evasion
T1078Valid Accounts
Persistence
CWE-290
Authentication Bypass by Spoofing

Authentication Bypass by Spoofing

Known Exploits & Detection

Miggo SecurityOriginal research and discovery details
NucleiDetection Template Available

Vulnerability Timeline

Fix Committed to GitHub
2024-06-05
Public Disclosure & CVE Published
2025-02-12

References & Sources

  • [1]GHSA Advisory
  • [2]AWS ALB OIDC Documentation

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•28 minutes ago•CVE-2026-55596
8.7

CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component

CVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.

Amit Schendel
Amit Schendel
0 views•6 min read
•about 1 hour ago•GHSA-8QX3-8GM5-9CJ2
7.8

GHSA-8QX3-8GM5-9CJ2: Terminal Escape-Sequence Injection in pickem

The npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).

Alon Barad
Alon Barad
3 views•6 min read
•about 2 hours ago•CVE-2026-55537
7.1

CVE-2026-55537: Webhook Server-Side Request Forgery and TOCTOU Bypass in PraisonAI

CVE-2026-55537 is a server-side request forgery (SSRF) and time-of-check time-of-use (TOCTOU) vulnerability in the PraisonAI multi-agent framework before version 4.6.58. The flaw exists in the job-submission component's webhook URL validation logic. When DNS resolution fails during verification, the application fails open, enabling attackers to register unresolvable URLs. When a completed job triggers the webhook, the application performs a fresh DNS resolution that attackers can manipulate to target internal resources.

Alon Barad
Alon Barad
6 views•6 min read
•about 3 hours ago•CVE-2026-54625
4.8

CVE-2026-54625: Server-Side Page Cache Bypass and Cache Poisoning in django CMS

Prior to version 5.0.8, django CMS fails to respect dynamically declared Vary HTTP headers in its internal page cache. This allows remote attackers to bypass authorization, leak sensitive information across user sessions, or poison the page cache by sending requests with custom headers.

Alon Barad
Alon Barad
5 views•7 min read
•about 4 hours ago•GHSA-W67G-5RQW-F597
6.9

GHSA-W67G-5RQW-F597: Cryptographically Weak PRNG for WebSocket Frame Masking in Gorilla WebSocket

A security vulnerability in the github.com/gorilla/websocket Go library allows remote attackers to predict client-to-server frame masking keys. This occurs because the library generates 32-bit mask keys using Go's non-cryptographically secure pseudo-random number generator (math/rand). Predicting these keys enables adversaries to bypass proxy-based security protections, facilitating HTTP request smuggling and cache poisoning attacks.

Amit Schendel
Amit Schendel
3 views•6 min read
•about 5 hours ago•CVE-2026-55477
7.2

CVE-2026-55477: Authenticated Arbitrary File Write in MHSanaei 3X-UI via Database Import

MHSanaei 3X-UI is a web control panel for managing Xray-core servers. In versions prior to 3.3.1, an authenticated administrator can abuse database import functions or raw template config fields to overwrite or append to arbitrary files on the host filesystem. This is achieved by altering the Xray log configuration variables to target system files, leveraging logging components to inject payloads.

Alon Barad
Alon Barad
6 views•6 min read