CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP affecting the HTTP authorization header. It allows remote unauthenticated attackers to authenticate as any known or guessable user, including administrative accounts, potentially leading to full system compromise. The vulnerability has a very high CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns. No affected versions or patch information is provided in the available data.