CVE-2025-64066: n/a
Source CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 26 Oct 2026, 07:57 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:LExploitation evidence
Disclosed: evidence found.
CVE published 25 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
Organizations should immediately audit their use of Primakon Pi Portal 1.0.18 and restrict access to the /api/v2/user/register endpoint to trusted networks or authenticated users only. Implement network-level controls such as firewalls or API gateways to block unauthorized POST requests to this endpoint. If possible, disable direct user registration via the local database and enforce registration exclusively through the external Identity Provider. Conduct thorough logging and monitoring of registration attempts to detect unusual activity or enumeration attempts. Review and harden access control policies within the application to ensure administrative functions cannot be bypassed. Engage with the vendor for patches or updates addressing this vulnerability and apply them promptly once available. Additionally, conduct penetration testing and vulnerability assessments to identify any chained vulnerabilities that could escalate the impact. Educate staff on social engineering risks related to user enumeration to reduce the likelihood of successful phishing attacks.
Description
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database. This bypasses the intended security architecture, which relies on an external Identity Provider for initial user registration and assumes that internal user creation is an administrative-only function. This vector can also be chained with other vulnerabilities for privilege escalation and complete compromise of application. This specific request can be used to also enumerate already registered user accounts, aiding in social engineering or further targeted attacks.