P4Verified

CVE-2025-12028: IndieAuth 0 through 4.5.4

CVE-2025-12028. CVSS 3.1 base score 8.8 (HIGH, Vendor/CNA). EPSS 0.00212 (percentile 0.10521), scored 06-Oct-2026.

Affected technology

IndieAuth · 0 through 4.5.4
indieweb

Component: Not specified by the source
Function: and

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete). Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.

Published 12-Oct-2026 00:35 UTC

CWE: CWE-352
CCR priority: 35.3 /100 (P4)
CVSS 3.1: 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00212 · percentile 0.10629 · 2026-10-11
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-08 17:32:11.049884+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-12028.html