CVE-2025-62376VulnerabilityPublished 14 Oct 2025Updated 3 Dec 2025

CVE-2025-62376: pwncollege dojo · Improper Authentication

Affects pwncollege dojoSource CVE Database V5

Not known to be exploited · CVSS 9.5 Critical.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 4.0 base score

9.5Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: High
Vulnerable system integrity: High
Vulnerable system availability: Low
Subsequent system confidentiality: High
Subsequent system integrity: High
Subsequent system availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: Present: The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include: a race condition must be won to successfully exploit the vulnerability (the successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker, or the attack may need to be launched multiple times against a single target before being successful); the attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: High: There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System.
Subsequent system confidentiality: High: There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Subsequent system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System.
Subsequent system availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Subsequent System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Subsequent System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Immediately update the pwn.college DOJO platform to the patched version including commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef or later to ensure proper authentication enforcement. 2. Restrict network access to the /workspace endpoint by implementing network segmentation and firewall rules limiting access to trusted users and IP ranges. 3. Monitor access logs for unusual or unauthorized attempts to access Windows VMs, focusing on anomalous URL parameter usage or repeated failed authentication attempts. 4. Employ multi-factor authentication (MFA) for administrative access to the DOJO platform to add an additional security layer beyond password validation. 5. Conduct regular security audits and penetration tests on the DOJO environment to detect any residual or new vulnerabilities. 6. Educate users and administrators about the risks of improper authentication and the importance of applying security patches promptly. 7. If immediate patching is not feasible, consider temporarily disabling the Windows VM feature or restricting its use until the fix can be applied. 8. Implement strict access controls on the underlying Linux systems to limit the impact of any VM compromise via the Z: drive linkage.

Description

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contains an improper authentication vulnerability that allows an attacker to access any active Windows VM without proper authorization. The vulnerability occurs in the view_desktop function where the user is retrieved via a URL parameter without verifying that the requester has administrative privileges. An attacker can supply any user ID and arbitrary password in the request parameters to impersonate another user. When requesting a Windows desktop service, the function does not validate the supplied password before generating access credentials, allowing the attacker to obtain an iframe source URL that grants full access to the target user's Windows VM. This impacts all users with active Windows VMs, as an attacker can access and modify data on the Windows machine and in the home directory of the associated Linux machine via the Z: drive. This issue has been patched in commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef. No known workarounds exist.

Impact

For European organizations utilizing pwn.college DOJO, particularly educational institutions and cybersecurity training centers, this vulnerability poses a significant risk of unauthorized access to sensitive virtual environments. Attackers exploiting this flaw can gain full control over Windows VMs, potentially leading to data theft, manipulation, or destruction within the virtual machines and linked Linux home directories. This could compromise the integrity of training exercises, leak sensitive educational or user data, and facilitate lateral movement within the network if the VMs are connected to broader infrastructure. The lack of authentication requirements and remote exploitability increase the likelihood of attacks, especially in environments where DOJO is exposed to the internet or insufficiently segmented. Additionally, the compromise of educational platforms could undermine trust in cybersecurity training programs and expose personal data of students and staff. The critical severity underscores the urgency for affected organizations to apply the patch promptly to avoid potential breaches and operational disruptions.

CWE-287Improper Authentication (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
V9.2.3 (opens in a new tab)
Attack patterns
Fake the Source of Data (opens in a new tab)
Utilizing REST's Trust in the System Resource to Obtain Sensitive Data (opens in a new tab)
Session Hijacking (opens in a new tab)
Token Impersonation (opens in a new tab)
Upload a Web Shell to a Web Server (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 3 Dec 2025, 16:37 UTC

WeaknessesCWE-287

Technical details

References

Community reviews

Related threats