CVE-2025-50325 describes an authentication bypass vulnerability in BandiZip v7.37. The flaw enables remote attackers to bypass the Mark-of-the-Web protection mechanism, which is designed to flag files downloaded from the internet for security purposes. The vulnerability is classified under CWE-693 (Protection Mechanism Failure). The CVSS v3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity. There is no vendor advisory or patch information available at this time.

The vulnerability allows remote attackers to bypass a security feature (Mark-of-the-Web) intended to warn users or systems about potentially unsafe files. This could lead to limited confidentiality and integrity impacts, such as executing files without expected security warnings. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening files with BandiZip and consider additional endpoint protections to compensate for the bypassed Mark-of-the-Web mechanism.