CVE-2025-30064 — Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm wa…
Published: 2025-08-27 · CVSS: 8.8 · CVSS 4.0
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7