Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.

CVE-2025-59101 is a vulnerability classified under CWE-291 (Reliance on IP Address for Authentication) found in dormakaba Access Manager 92xx-k5 versions prior to XAMB 04.06.212. The product’s authentication mechanism deviates from standard practices by not using session tokens or cookies to maintain authenticated sessions. Instead, it verifies each request by checking if the originating IP address has previously authenticated successfully. Once an IP address is authenticated, the system treats all subsequent requests from that IP as authenticated, without additional verification. This approach is inherently insecure because IP addresses can be spoofed by attackers, especially in environments where IP spoofing is feasible. An attacker who can spoof the IP address of a legitimate user can bypass authentication controls and gain unauthorized access to the Access Manager web interface. This interface controls access management functions, which are critical for physical and logical security in organizations. The vulnerability has a CVSS 4.0 base score of 7.7 (high severity), reflecting its network attack vector, low attack complexity, no required privileges, partial user interaction, and high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to the critical nature of the affected system and the ease of exploitation in certain network environments. The flaw highlights a fundamental design weakness in the authentication mechanism that should be addressed by applying patches or updates once available. Until then, organizations must rely on compensating controls to reduce exposure.

Detailed information about CVE-2025-59101: CWE-291: Reliance on IP Address for Authentication in dormakaba Access Manager 92xx-k5 affecting dormakaba Access Man

CVE-2025-59101: CWE-291: Reliance on IP Address for Authentication in dormakaba Access Manager 92xx-k5 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-59101: CWE-291: Reliance on IP Address for Authentication in dormakaba Access Manager 92xx-k5

Threats Tagged 'cve-2025-59101'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-59101'

Lead Pen Test Professional