CVE-2025-29906 — Finit bundled getty can bypass /bin/login
Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can…
Published: 2025-04-29 · CVSS: 8.6 · CVSS 3.1
Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7