CVE-2025-55278: HCL Software DevOps Loop · Insufficient Session Expiration
Affects HCL Software DevOps LoopSource CVE Database V5
Not known to be exploited · CVSS 8.1 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL Software DevOps Loop | Affected
| Fixed in– |
AI-suggested
- Immediately audit and monitor all authentication logs for unusual token usage patterns, such as reuse of expired tokens or tokens with invalid signatures.
- Implement additional validation layers at the API gateway or reverse proxy level to enforce strict token expiration and signature verification until an official patch is released.
- Employ short-lived tokens and enforce token revocation policies to minimize the window of exploitation.
- Restrict access to the DevOps Loop API to trusted IP ranges and require multi-factor authentication for all users interacting with the system.
- Educate users about phishing and social engineering risks that could facilitate token misuse.
- Prepare to deploy patches promptly once HCL releases them and test updates in a staging environment before production rollout.
- Consider network segmentation to isolate DevOps infrastructure from critical production systems to limit potential lateral movement.
- Engage with HCL support and subscribe to security advisories for timely updates.
Description
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.