CVE-2025-54320: Ascertia SigningHub · Unthrottled Resource Allocation
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- Ascertia SigningHub through 8.6.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 18 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-54320, organizations should implement strict rate limiting on the invite user functionality to prevent automated mass invitation requests. This can be done by configuring application-level throttling or deploying web application firewalls (WAFs) with custom rules to detect and block rapid repeated invite attempts. Monitoring and alerting on unusual invite activity patterns can help identify potential abuse early. Enforcing strong authentication mechanisms, such as multi-factor authentication (MFA), reduces the risk of credential compromise that enables exploitation. Organizations should also review user permissions to restrict invite capabilities to trusted roles only. Once Ascertia releases official patches or updates addressing this vulnerability, prompt application of these fixes is essential. Additionally, educating users about suspicious invite emails and maintaining robust email filtering policies can mitigate downstream effects of email bombing. Regular security assessments and penetration testing focused on resource exhaustion vectors will help detect similar issues proactively.
Description
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.