CVE-2023-25560
criticalpriority · track · 39EPSS 0.006 · 50 %ileEUUSEPSS · scored 2026-10-27
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.2–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-25560/cnnvd
- https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3cnnvd
- https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3enisa_euvd
- https://github.com/datahub-project/datahub/security/advisories/GHSA-6rpf-5cfg-h8f3Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan