CVE-2025-61114: Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-61114, organizations should immediately verify if they use the affected versions of the 2nd Line Android app and coordinate with AutoBizLine, Inc. for patches or updates. In the absence of an official patch, organizations should: 1) Implement server-side fixes to validate the entire user_token rather than just the first character, ensuring robust authentication checks. 2) Introduce rate limiting and anomaly detection on authentication endpoints to prevent brute force token guessing. 3) Employ multi-factor authentication (MFA) to add an additional security layer beyond token validation. 4) Conduct thorough audits of user account access logs to detect suspicious activities. 5) Educate users about potential phishing or social engineering attacks that could leverage this vulnerability. 6) If possible, temporarily disable or restrict access to the affected app until a secure version is deployed. 7) Review and enhance overall access control policies and token management practices to prevent similar issues. These steps will reduce the risk of unauthorized access and limit potential damage.
Description
2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the user_token, enabling attackers to brute force tokens and perform unauthorized queries on other user accounts. Successful exploitation could result in privacy breaches and unauthorized access to user data.