CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-42602: Improper Authentication Vulnerability in Meon KYC solutions

8.2 CVSS

Description

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to unauthorized access of other user accounts.

Classification

CVE ID: CVE-2025-42602

CVSS Base Severity: HIGH

CVSS Base Score: 8.2

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Problem Types

CWE-613: Insufficient Session Expiration CWE-384: Session Fixation

Affected Products

Vendor: Meon

Product: KYC solutions

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.26% (probability of being exploited)

EPSS Percentile: 49.18% (scored less or equal to compared to others)

EPSS Date: 2025-05-22 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-42602
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082

Timeline