CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-25182

Trust Issues: Stroom Auth Bypass & SSRF via AWS ALB Spoofing

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·42 visits

Executive Summary (TL;DR)

Stroom trusted the 'signer' field in AWS ALB headers without verification. Attackers can bring their own ALB signatures to log in as anyone, or inject malicious regions into the signer ARN to trigger SSRF against the AWS Metadata Service (IMDS).

A critical authentication bypass and SSRF vulnerability in GCHQ's Stroom data platform allows attackers to spoof AWS Application Load Balancer identities or reach internal AWS metadata services.

Official Patches

GCHQPull Request #4320 fixing the vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score
9.4/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Probability
0.33%
Top 45% most exploited

Affected Systems

Stroom Data Platform (GCHQ)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Stroom
GCHQ
>= 7.2-beta.53, < 7.2.247.2.24
Stroom
GCHQ
7.3-beta.1 - < 7.3-beta.227.3-beta.22
Stroom
GCHQ
7.4-beta.1 - < 7.4.47.4.4
Stroom
GCHQ
7.5-beta.17.5-beta.2
AttributeDetail
CWECWE-290 (Auth Bypass by Spoofing)
CVSS9.4 (Critical)
Attack VectorNetwork
Exploit StatusPoC Available
ImpactAuthentication Bypass / SSRF
KEV StatusNot Listed

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1553Subvert Trust Controls
Defense Evasion
T1078Valid Accounts
Persistence
CWE-290
Authentication Bypass by Spoofing

Authentication Bypass by Spoofing

Known Exploits & Detection

Miggo SecurityOriginal research and discovery details
NucleiDetection Template Available

Vulnerability Timeline

Fix Committed to GitHub
2024-06-05
Public Disclosure & CVE Published
2025-02-12

References & Sources

  • [1]GHSA Advisory
  • [2]AWS ALB OIDC Documentation

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•28 minutes ago•CVE-2026-54284
8.7

CVE-2026-54284: Algorithmic Complexity Exhaustion in sqlparse Engine

An algorithmic complexity vulnerability in the python-sqlparse library allows remote, unauthenticated attackers to cause a Denial of Service (DoS) via resource exhaustion. By transmitting a carefully constructed SQL statement containing deeply nested structures, an attacker can trigger quadratic CPU consumption within the parsing engine. This behavior bypasses the built-in depth limits because the performance degradation occurs during the initial recursive tree construction, causing the application process to hang.

Alon Barad
Alon Barad
0 views•6 min read
•about 2 hours ago•GHSA-XHCR-CQFR-M3HV
8.7

GHSA-XHCR-CQFR-M3HV: Remote Code Execution via Insecure HTTP MCP Server Registry in atomic-agents-stack

A critical vulnerability exists in the atomic-agents-stack package up to version 1.0.0. The HTTP Model Context Protocol (MCP) server-registry backend factory retrieves catalog metadata over cleartext HTTP by default. Because these catalogs define execution parameters ('command' and 'args') for local stdio subprocesses, a network-positioned attacker can intercept the cleartext traffic and inject arbitrary commands. This results in arbitrary remote code execution on the agent host system without requiring user interaction.

Alon Barad
Alon Barad
1 views•6 min read
•about 2 hours ago•GHSA-J659-8XH6-5PQ5
8.7

GHSA-J659-8XH6-5PQ5: Financial Guardrail Bypass in atomic-agents-stack via Parallel Execution of Unlisted Models

A high-severity vulnerability in the atomic-agents-stack framework allows complete bypass of cost-cap guardrails during parallel model execution when utilizing unlisted, local, or self-hosted models.

Amit Schendel
Amit Schendel
4 views•7 min read
•about 7 hours ago•GHSA-MPWR-8VM7-H73F
7.4

GHSA-mpwr-8vm7-h73f: Key Space Collapse and Authentication Bypass in go-pkcs12 PBMAC1 Decoding

A security vulnerability in the Go library software.sslmate.com/src/go-pkcs12 allows remote attackers to bypass password-based integrity verification. By crafting a PKCS#12 file with an excessively short KeyLength parameter in the PBMAC1 configuration, the derived MAC key space collapses, allowing an attacker to forge arbitrary certificate structures and private keys that are incorrectly verified as valid.

Amit Schendel
Amit Schendel
4 views•7 min read
•about 10 hours ago•CVE-2026-53766
6.1

CVE-2026-53766: Workspace Boundary Bypass in chrome-devtools-mcp via Symbolic Link Resolution Failure

A workspace boundary bypass vulnerability exists in the Chrome DevTools for Agents (chrome-devtools-mcp) Model Context Protocol (MCP) server from version 0.24.0 up to 1.1.0. The vulnerability allows an agent or malicious workspace containing symbolic links to read or modify arbitrary files outside the configured project workspace root directory. This occurs because the path validation function resolves paths lexically rather than physically.

Alon Barad
Alon Barad
3 views•7 min read
•about 12 hours ago•CVE-2026-56677
8.6

CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

A high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.

Amit Schendel
Amit Schendel
3 views•5 min read